openapi: 3.1.0
servers:
  - url: /
info:
  title: Cribl API Reference
  description: >-
    This API Reference lists available REST endpoints, along with their
    supported operations for accessing, creating, updating, or deleting
    resources.

    Base URL contexts for reference:

    - Leader context: /api/v1

    - Worker Group or Edge Fleet context: /api/v1/m/{groupName}

    - Host (Worker or Edge Node) context: /api/v1/w/{nodeId}

    - Search context: /api/v1/m/default_search
  version: 4.18.2-fd1f0d2f
  contact:
    name: Support
    url: https://portal.support.cribl.io
externalDocs:
  description: See our complementary product documentation
  url: https://docs.cribl.io
x-speakeasy-retries:
  strategy: backoff
  statusCodes:
    - "429"
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
  schemas:
    Error:
      type: object
      properties:
        message:
          type: string
          description: Error message
    DiffLineDelete:
      type: object
      properties:
        type:
          type: string
          enum:
            - delete
        oldNumber:
          type: number
        content:
          type: string
      required:
        - type
        - oldNumber
        - content
    DiffLineInsert:
      type: object
      properties:
        type:
          type: string
          enum:
            - insert
        newNumber:
          type: number
        content:
          type: string
      required:
        - type
        - newNumber
        - content
    DiffLineContext:
      type: object
      properties:
        type:
          type: string
          enum:
            - context
        newNumber:
          type: number
        oldNumber:
          type: number
        content:
          type: string
      required:
        - type
        - newNumber
        - oldNumber
        - content
    DiffLine:
      description: Diff Line
      type: array
      items:
        oneOf:
          - $ref: "#/components/schemas/DiffLineDelete"
          - $ref: "#/components/schemas/DiffLineInsert"
          - $ref: "#/components/schemas/DiffLineContext"
        discriminator:
          propertyName: type
          mapping:
            delete: "#/components/schemas/DiffLineDelete"
            insert: "#/components/schemas/DiffLineInsert"
            context: "#/components/schemas/DiffLineContext"
    EnrichedFields:
      type: object
      properties:
        savedState:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeEnrichedFieldsSavedState"
          description: Runtime collection state.
        notifications:
          type: array
          items:
            $ref: "#/components/schemas/Notification"
          description: Notification targets.
    EventBreakerExistingOrNewNewTimestampTypeAuto:
      type: object
      properties:
        type:
          enum:
            - auto
          type: string
        length:
          type: number
          title: Length
          minimum: 2
      required:
        - length
    EventBreakerExistingOrNewNewTimestampTypeFormat:
      type: object
      properties:
        type:
          enum:
            - format
          type: string
        format:
          type: string
          title: Format
      required:
        - format
    EventBreakerExistingOrNewNewTimestampTypeCurrent:
      type: object
      properties:
        type:
          enum:
            - current
          type: string
    EventBreakerExistingOrNewNewRuleTypeRegex:
      type: object
      properties:
        ruleType:
          enum:
            - regex
          type: string
        eventBreakerRegex:
          type: string
          title: Event Breaker
          description: The regex used to break the stream into events at the beginning of
            the match. Matched content will be consumed, unless you use a
            lookahead regex such as (?=pattern) to keep it. Do NOT use capturing
            groups in the pattern.
      required:
        - eventBreakerRegex
    EventBreakerExistingOrNewNewRuleTypeJson:
      type: object
      properties:
        ruleType:
          enum:
            - json
            - timestamp
            - aws_cloudtrail
            - aws_vpcflow
            - azure_flowlog
          type: string
    EventBreakerExistingOrNewNewRuleTypeJsonArray:
      type: object
      properties:
        ruleType:
          enum:
            - json_array
          type: string
        jsonArrayField:
          type: string
          title: Array field
          description: The path to an array in a JSON event with records to extract, such
            as Records or level1.level2.events. Leave blank if result itself is
            an array, such as [{...},{...}]
        parentFieldsToCopy:
          title: Parent fields to copy
          description: Top-level fields to copy to the output events. Nested fields are
            not supported. 'Array field' is always excluded. If 'Array field'
            points to a nested array, the entire top-level object will be
            excluded. Supports * wildcards. Enclose field names containing
            special characters in single or double quotes.
          type: array
          items:
            type: string
        jsonExtractAll:
          type: boolean
          title: JSON extract fields
          description: Automatically extract fields from JSON events. When disabled, only
            _raw and _time are defined on extracted events.
        fieldsToRemove:
          title: Fields to remove
          description: List of fields to remove from the output events. Supports *
            wildcards. Enclose field names containing special characters in
            single or double quotes.
          type: array
          items:
            type: string
        jsonTimeField:
          type: string
          title: Timestamp field
          description: Optional path to timestamp field in extracted events, such as
            eventTime or level1.level2.eventTime.
    EventBreakerExistingOrNewNewRuleTypeHeader:
      type: object
      properties:
        ruleType:
          enum:
            - header
          type: string
        delimiterRegex:
          type: string
          title: Field delimiter
          description: Field delimiter regex
        fieldsLineRegex:
          type: string
          title: Fields regex
          description: Regex with one capturing group that captures all fields (and
            delimiters) to be broken by field delimiter
        headerLineRegex:
          type: string
          title: Header line
          description: Regex matching a file header line
        nullFieldVal:
          type: string
          title: Null value
          description: Representation of a null value. Null fields are not added to events.
        cleanFields:
          type: boolean
          title: Clean fields
          description: Clean field names by replacing non [a-zA-Z0-9] characters with _
      required:
        - delimiterRegex
        - fieldsLineRegex
        - headerLineRegex
    EventBreakerExistingOrNewNewRuleTypeCsv:
      type: object
      properties:
        ruleType:
          enum:
            - csv
          type: string
        delimiter:
          type: string
          title: Delimiter
          minLength: 1
          description: Delimiter character to use to split values
        quoteChar:
          type: string
          title: Quote char
          minLength: 1
          description: Character used to quote literal values
        escapeChar:
          type: string
          title: Escape char
          minLength: 1
          description: Character used to escape the quote character in field values
        timeField:
          type: string
          title: Timestamp field
          description: Optional timestamp field name in extracted events
      required:
        - delimiter
        - quoteChar
        - escapeChar
    EventBreakerExistingOrNewNew:
      type: object
      properties:
        existingOrNew:
          enum:
            - new
          type: string
        ruleType:
          $ref: "#/components/schemas/EventBreakerTypeOptionsEventBreakerExistingOrNewNew"
        maxEventBytes:
          type: number
          title: Event byte limit
          description: The maximum number of bytes that an event can be before being
            flushed to the Pipelines
          minimum: 1
          maximum: 134217728
        timestampAnchorRegex:
          type: string
          title: Timestamp anchor
          description: Regex to match before attempting timestamp extraction. Use $ (end
            of string anchor) to not perform extraction.
        timestamp:
          $ref: "#/components/schemas/TimestampFormatTypeEventBreakerExistingOrNewNew"
        timestampTimezone:
          type: string
          title: Default timezone
          description: Timezone to assign to timestamps without timezone info
        timestampEarliest:
          title: Earliest timestamp allowed
          description: The earliest timestamp value allowed relative to now, such as
            -42years. Parsed values prior to this date will be set to current
            time.
          type: string
        timestampLatest:
          title: Future timestamp allowed
          description: The latest timestamp value allowed relative to now, such as
            +42days. Parsed values after this date will be set to current time.
          type: string
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/EventBreakerExistingOrNewNewRuleTypeRegex"
            - $ref: "#/components/schemas/EventBreakerExistingOrNewNewRuleTypeJson"
            - $ref: "#/components/schemas/EventBreakerExistingOrNewNewRuleTypeJsonArray"
            - $ref: "#/components/schemas/EventBreakerExistingOrNewNewRuleTypeHeader"
            - $ref: "#/components/schemas/EventBreakerExistingOrNewNewRuleTypeCsv"
          discriminator:
            propertyName: ruleType
            mapping:
              regex: "#/components/schemas/EventBreakerExistingOrNewNewRuleTypeRegex"
              json: "#/components/schemas/EventBreakerExistingOrNewNewRuleTypeJson"
              json_array: "#/components/schemas/EventBreakerExistingOrNewNewRuleTypeJsonArray"
              header: "#/components/schemas/EventBreakerExistingOrNewNewRuleTypeHeader"
              csv: "#/components/schemas/EventBreakerExistingOrNewNewRuleTypeCsv"
    EventBreakerExistingOrNewExisting:
      type: object
      properties:
        existingOrNew:
          enum:
            - existing
          type: string
        existingRule:
          type: string
          title: Existing ruleset
          minLength: 1
    NumerifyFormatFix:
      type: object
      properties:
        format:
          enum:
            - fix
          type: string
        digits:
          type: number
          title: Digits
          description: Number of digits after the decimal point, between 0 and 20. If left
            blank, defaults to 2.
          minimum: 0
          maximum: 20
    NumerifyFormatNone:
      type: object
      properties:
        format:
          enum:
            - none
            - floor
            - ceil
          type: string
    RedisDeploymentTypeStandalone:
      type: object
      properties:
        deploymentType:
          enum:
            - standalone
          type: string
        url:
          title: Redis URL
          description: "Redis URL to connect to. Format:
            redis[s]://[[user][:password@]][host][:port][/db-number][?db=db-num\
            ber[&password=bar[&option=value]]]. Must be a JavaScript expression
            (which can evaluate to a constant value), enclosed in quotes or
            backticks. Can be evaluated only at init time. Example referencing a
            Global Variable: `myBucket-${C.vars.myVar}`"
          type: string
        tlsOptions:
          $ref: "#/components/schemas/TlsOptionsTypeRedisDeploymentTypeStandalone"
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
      required:
        - url
    RedisDeploymentTypeCluster:
      type: object
      properties:
        deploymentType:
          enum:
            - cluster
          type: string
        rootNodes:
          title: Root nodes
          description: Root nodes to which the cluster connection should be initiated
          type: array
          minItems: 1
          items:
            $ref: "#/components/schemas/RootNodeConfRedisDeploymentTypeCluster"
        tls:
          title: TLS
          type: boolean
          description: Use TLS for connections to this cluster
        scaleReads:
          $ref: "#/components/schemas/ScaleReadsOptionsRedisDeploymentTypeCluster"
        tlsOptions:
          $ref: "#/components/schemas/TlsOptionsTypeRedisDeploymentTypeCluster"
    RedisDeploymentTypeSentinel:
      type: object
      properties:
        deploymentType:
          enum:
            - sentinel
          type: string
        masterName:
          title: Master group name
          type: string
        rootNodes:
          title: Sentinels
          description: List of sentinels to be used
          type: array
          minItems: 1
          items:
            type: object
            required:
              - host
              - port
            properties:
              host:
                type: string
                title: Hostname
                description: "Hostname of sentinel node. Must be a JavaScript expression (which
                  can evaluate to a constant value), enclosed in quotes or
                  backticks. Can be evaluated only at init time. Example
                  referencing a Global Variable: `myBucket-${C.vars.myVar}`."
              port:
                type: number
                title: Port
                description: Port of sentinel node
        tls:
          title: TLS
          type: boolean
          description: Use TLS for connections to this cluster
        tlsOptions:
          $ref: "#/components/schemas/TlsOptionsTypeRedisDeploymentTypeCluster"
      required:
        - masterName
    RedisAuthTypeNone:
      type: object
      properties:
        authType:
          enum:
            - none
          type: string
    RedisAuthTypeManual:
      type: object
      properties:
        authType:
          enum:
            - manual
          type: string
        username:
          title: Username
          type: string
        password:
          title: Password
          type: string
        __template_username:
          type: string
          description: Binds 'username' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'username' at runtime.
        __template_password:
          type: string
          description: Binds 'password' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'password' at runtime.
      required:
        - password
    RedisAuthTypeCredentialsSecret:
      type: object
      properties:
        authType:
          enum:
            - credentialsSecret
          type: string
        credentialsSecret:
          type: string
          title: User secret
          description: Secret that references Redis username and password
      required:
        - credentialsSecret
    RedisAuthTypeTextSecret:
      type: object
      properties:
        authType:
          enum:
            - textSecret
          type: string
        textSecret:
          type: string
          title: Admin secret
          description: Secret that references Redis admin password
      required:
        - textSecret
    SerdeTypeKvp:
      type: object
      properties:
        type:
          enum:
            - kvp
          type: string
        keep:
          title: Fields to keep
          description: List of fields to keep. Supports wildcards (*). Takes precedence
            over 'Fields to remove'.
          type: array
          items:
            type: string
        remove:
          title: Fields to remove
          description: List of fields to remove. Supports wildcards (*). Cannot remove
            fields that match 'Fields to keep'.
          type: array
          items:
            type: string
        fieldFilterExpr:
          title: Fields filter expression
          description: Expression evaluated against {index, name, value} context. Return
            truthy to keep a field, or falsy to remove it.
          type: string
        cleanFields:
          type: boolean
          title: Clean fields
          description: Clean field names by replacing non [a-zA-Z0-9] characters with _
        allowedKeyChars:
          type: array
          items:
            type: string
          title: Allowed key characters
          description: A list of characters that may be present in a key name, even though
            they are normally separator or control characters
        allowedValueChars:
          type: array
          items:
            type: string
          title: Allowed value characters
          description: A list of characters that may be present in a value, even though
            they are normally separator or control characters
    SerdeTypeDelim:
      type: object
      properties:
        type:
          enum:
            - delim
          type: string
        fields:
          title: List of fields
          description: The fields to be extracted, listed in order. Will auto-generate if
            empty.
          type: array
          items:
            type: string
        keep:
          title: Fields to keep
          description: List of fields to keep. Supports wildcards (*). Takes precedence
            over 'Fields to remove'.
          type: array
          items:
            type: string
        remove:
          title: Fields to remove
          description: List of fields to remove. Supports wildcards (*). Cannot remove
            fields that match 'Fields to keep'.
          type: array
          items:
            type: string
        fieldFilterExpr:
          title: Fields filter expression
          description: Expression evaluated against {index, name, value} context. Return
            truthy to keep a field, or falsy to remove it.
          type: string
        delimChar:
          type: string
          title: Delimiter
          minLength: 1
          description: Delimiter character to use to split values
        quoteChar:
          type: string
          title: Quote char
          minLength: 1
          description: Character used to quote literal values
        escapeChar:
          type: string
          title: Escape char
          minLength: 1
          description: Escape character used to escape delimiter or quote character
        nullValue:
          type: string
          title: Null value
          description: Field value representing the null value. Null fields will be omitted.
    SerdeTypeCsv:
      type: object
      properties:
        type:
          enum:
            - csv
            - elff
            - clf
          type: string
        fields:
          title: List of fields
          description: The fields to be extracted, listed in order. Will auto-generate if
            empty.
          type: array
          items:
            type: string
        keep:
          title: Fields to keep
          description: List of fields to keep. Supports wildcards (*). Takes precedence
            over 'Fields to remove'.
          type: array
          items:
            type: string
        remove:
          title: Fields to remove
          description: List of fields to remove. Supports wildcards (*). Cannot remove
            fields that match 'Fields to keep'.
          type: array
          items:
            type: string
        fieldFilterExpr:
          title: Fields filter expression
          description: Expression evaluated against {index, name, value} context. Return
            truthy to keep a field, or falsy to remove it.
          type: string
    SerdeTypeJson:
      type: object
      properties:
        type:
          enum:
            - json
          type: string
        keep:
          title: Fields to keep
          description: List of fields to keep. Supports wildcards (*). Takes precedence
            over 'Fields to remove'.
          type: array
          items:
            type: string
        remove:
          title: Fields to remove
          description: List of fields to remove. Supports wildcards (*). Cannot remove
            fields that match 'Fields to keep'.
          type: array
          items:
            type: string
        fieldFilterExpr:
          title: Fields filter expression
          description: Expression evaluated against {index, name, value} context. Return
            truthy to keep a field, or falsy to remove it.
          type: string
    SerdeTypeRegex:
      type: object
      properties:
        type:
          enum:
            - regex
          type: string
        regex:
          type: string
          title: Regex
          description: Regex literal with named capturing groups, such as (?<foo>bar), or
            _NAME_ and _VALUE_ capturing groups, such as(?<_NAME_0>[^
            =]+)=(?<_VALUE_0>[^,]+)
        regexList:
          type: array
          title: Additional regex
          items:
            $ref: "#/components/schemas/RegexListConfSerdeTypeRegex"
        iterations:
          type: number
          title: Max exec
          description: The maximum number of times to apply regex to source field when the
            global flag is set, or when using _NAME_ and _VALUE_ capturing
            groups
          minimum: 1
        fieldNameExpression:
          title: Field name format expression
          description: "JavaScript expression to format field names when _NAME_n and
            _VALUE_n capturing groups are used. Original field name is in global
            variable 'name'. Example: To append XX to all field names, use
            `${name}_XX` (backticks are literal). If empty, names will be
            sanitized using this regex: /^[_0-9]+|[^a-zA-Z0-9_]+/g. You can
            access other fields values via __e.<fieldName>."
          type: string
        overwrite:
          type: boolean
          title: Overwrite existing fields
          description: Overwrite existing event fields with extracted values. If disabled,
            existing fields will be converted to an array.
      required:
        - regex
    SerdeTypeGrok:
      type: object
      properties:
        type:
          enum:
            - grok
          type: string
        pattern:
          type: string
          title: Pattern
          description: "Grok pattern to extract fields. Syntax supported:
            %{PATTERN_NAME:FIELD_NAME}"
        patternList:
          type: array
          title: Additional Grok patterns
          items:
            $ref: "#/components/schemas/PatternListConfSerdeTypeGrok"
      required:
        - pattern
    SerializeTypeKvp:
      type: object
      properties:
        type:
          enum:
            - kvp
          type: string
        cleanFields:
          type: boolean
          title: Clean fields
          description: Clean field names by replacing non-[a-zA-Z0-9] characters with _
        fields:
          title: Fields to serialize
          description: "Required for CSV, ELFF, and CLF. All other formats support
            wildcard field lists. Examples: host, myField, !source *"
          type: array
          items:
            type: string
        pairDelimiter:
          type: string
          title: Pair delimiter
          minLength: 1
          description: Delimiter used to separate key=value pairs. Defaults to a single
            space character. Should not have common characters with key-value
            delimiter.
        keyValueDelimiter:
          type: string
          title: Key-Value delimiter
          minLength: 1
          description: Delimiter used to separate key and value in pair. Defaults to a
            '='. Should not have common characters with pair delimiter.
    SerializeTypeDelim:
      type: object
      properties:
        type:
          enum:
            - delim
          type: string
        delimChar:
          type: string
          title: Delimiter
          minLength: 1
          description: Delimiter character to use to split values. If left blank, will
            default to ','.
        quoteChar:
          type: string
          title: Quote char
          minLength: 1
          description: Character used to quote literal values. If left blank, will default
            to '"'.
        escapeChar:
          type: string
          title: Escape char
          minLength: 1
          description: Escape character used to escape delimiter or quote character. If
            left blank, will default to the Quote char.
        nullValue:
          type: string
          title: Null value
          description: Field value representing the null value. Null fields will be omitted.
    SerializeTypeCsv:
      type: object
      properties:
        type:
          enum:
            - csv
            - elff
            - clf
            - json
          type: string
    SnmpTrapSerializeV3UserAuthProtocolNone:
      type: object
      properties:
        authProtocol:
          enum:
            - none
          type: string
    SnmpTrapSerializeV3UserAuthProtocolNotNonePrivProtocolNone:
      type: object
      properties:
        privProtocol:
          enum:
            - none
          type: string
    SnmpTrapSerializeV3UserAuthProtocolNotNonePrivProtocolNotNone:
      type: object
      properties:
        privProtocol:
          type: string
          enum:
            - des
            - aes
            - aes256b
            - aes256r
          x-speakeasy-unknown-values: allow
        privKey:
          type: string
          title: V3 privacy key
      required:
        - privKey
    SnmpTrapSerializeV3UserAuthProtocolNotNone:
      type: object
      properties:
        authProtocol:
          type: string
          enum:
            - md5
            - sha
            - sha224
            - sha256
            - sha384
            - sha512
          x-speakeasy-unknown-values: allow
        authKey:
          type: string
          title: V3 authentication key
        privProtocol:
          $ref: "#/components/schemas/PrivacyProtocolOptionsSnmpTrapSerializeV3UserAuthPr\
            otocolNotNone"
        name:
          title: Username
          type: string
          minLength: 1
      required:
        - authKey
        - name
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNonePrivProto\
                colNone"
            - $ref: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNonePrivProto\
                colNotNone"
          discriminator:
            propertyName: privProtocol
            mapping:
              none: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNonePrivProto\
                colNone"
              des: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNonePrivProtoc\
                olNotNone"
              aes: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNonePrivProtoc\
                olNotNone"
              aes256b: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNonePrivPr\
                otocolNotNone"
              aes256r: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNonePrivPr\
                otocolNotNone"
    FunctionConfSchemaAggregateMetrics:
      type: object
      properties:
        passthrough:
          type: boolean
          title: Passthrough mode
          description: Pass through the original events along with the aggregation events
        preserveGroupBys:
          type: boolean
          title: Preserve group by fields
          description: Preserve the structure of the original aggregation event's groupby
            fields
        sufficientStatsOnly:
          type: boolean
          title: Sufficient stats mode
          description: Output only statistics that are sufficient for the supplied
            aggregations
        prefix:
          type: string
          title: Output prefix
          description: A prefix that is prepended to all of the fields output by this
            Aggregations Function
        timeWindow:
          pattern: \d+[sm]$
          type: string
          title: Time window
          description: The time span of the tumbling window for aggregating events. Must
            be a valid time string (such as 10s).
        aggregations:
          type: array
          title: Aggregates
          description: Combination of Aggregation function and output metric type
          minItems: 1
          items:
            type: object
            required:
              - agg
              - metricType
            additionalProperties: false
            properties:
              metricType:
                title: Metric type
                description: The output metric type
                type: string
                enum:
                  - automatic
                  - counter
                  - distribution
                  - gauge
                  - histogram
                  - summary
                  - timer
                x-speakeasy-unknown-values: allow
              agg:
                title: Aggregation
                type: string
                description: "Aggregate function to perform on events. Example:
                  sum(bytes).where(action=='REJECT').as(TotalBytes)"
        groupbys:
          type: array
          title: Group by dimensions
          description: "Optional: One or more dimensions to group aggregates by. Supports
            wildcard expressions. Wrap dimension names in quotes if using
            literal identifiers, such as 'service.name'. Warning: Using wildcard
            '*' causes all dimensions in the event to be included, which can
            result in high cardinality and increased memory usage. Exclude
            dimensions that can result in high cardinality before using
            wildcards. Example: !_time, !_numericValue, *"
          items:
            type: string
        flushEventLimit:
          type: number
          title: Aggregation event limit
          description: The maximum number of events to include in any given aggregation
            event
          minimum: 1
        flushMemLimit:
          type: string
          title: Aggregation memory limit
          description: "The memory usage limit to impose upon aggregations. Defaults to
            80% of the process memory; value configured above default limit is
            ignored. Accepts numerals with units like KB and MB (example:
            128MB)."
          pattern: ^\d+\s*(?:\w{2})?$
        cumulative:
          type: boolean
          title: Cumulative aggregations
          description: Enable to retain aggregations for cumulative aggregations when
            flushing out an aggregation table event. When disabled (the
            default), aggregations are reset to 0 on flush.
        shouldTreatDotsAsLiterals:
          type: boolean
          title: Treat dots as literals
          description: Treat dots in dimension names as literals. This is useful for
            top-level dimensions that contain dots, such as 'service.name'.
        add:
          title: Evaluate fields
          description: Set of key-value pairs to evaluate and add/set
          type: array
          items:
            type: object
            required:
              - value
            properties:
              name:
                type: string
                title: Name
              value:
                type: string
                title: Value expression
                description: JavaScript expression to compute the value (can be constant)
        flushOnInputClose:
          type: boolean
          title: Flush on stream close
          description: Flush aggregations when an input stream is closed. If disabled,
            Time Window Settings control flush behavior.
        lagTolerance:
          type: string
          title: Lag tolerance
          description: The tumbling window tolerance to late events. Must be a valid time
            string (such as 10s).
          pattern: \d+[sm]$
        idleTimeLimit:
          type: string
          title: Idle bucket time limit
          description: How long to wait before flushing a bucket that has not received
            events. Must be a valid time string (such as 10s).
          pattern: \d+[sm]$
    FunctionAggregateMetrics:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - aggregate_metrics
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaAggregation:
      type: object
      properties:
        passthrough:
          type: boolean
          title: Passthrough mode
          description: Pass through the original events along with the aggregation events
        preserveGroupBys:
          type: boolean
          title: Preserve group by fields
          description: Preserve the structure of the original aggregation event's groupby
            fields
        sufficientStatsOnly:
          type: boolean
          title: Sufficient stats mode
          description: Output only statistics that are sufficient for the supplied
            aggregations
        metricsMode:
          type: boolean
          title: Metrics mode
          description: Enable to output the aggregates as metrics. When disabled,
            aggregates are output as events.
        prefix:
          type: string
          title: Output prefix
          description: A prefix that is prepended to all of the fields output by this
            Aggregations Function
        timeWindow:
          pattern: \d+[sm]$
          type: string
          title: Time window
          description: The time span of the tumbling window for aggregating events. Must
            be a valid time string (such as 10s).
        aggregations:
          type: array
          title: Aggregates
          description: "Aggregate function to perform on events. Example:
            sum(bytes).where(action=='REJECT').as(TotalBytes)"
          minItems: 1
          items:
            type: string
        groupbys:
          type: array
          title: Group by fields
          description: "Optional: One or more fields to group aggregates by. Supports
            wildcard expressions. Warning: Using wildcard '*' causes all fields
            in the event to be included, which can result in high cardinality
            and increased memory usage. Exclude fields that can result in high
            cardinality before using wildcards. Example: !_time, !_numericValue,
            *"
          items:
            type: string
        flushEventLimit:
          type: number
          title: Aggregation event limit
          description: The maximum number of events to include in any given aggregation
            event
          minimum: 1
        flushMemLimit:
          type: string
          title: Aggregation memory limit
          description: "The memory usage limit to impose upon aggregations. Defaults to
            80% of the process memory; value configured above default limit is
            ignored. Accepts numerals with units like KB and MB (example:
            128MB)."
          pattern: ^\d+\s*(?:\w{2})?$
        cumulative:
          type: boolean
          title: Cumulative aggregations
          description: Enable to retain aggregations for cumulative aggregations when
            flushing out an aggregation table event. When disabled (the
            default), aggregations are reset to 0 on flush.
        searchAggMode:
          type: string
          title: Search-specific aggregation mode
          description: Allows Cribl Search-specific aggregation configuration
        add:
          title: Evaluate fields
          description: Set of key-value pairs to evaluate and add/set
          type: array
          items:
            $ref: "#/components/schemas/AddConfFunctionConfSchemaAggregation"
        shouldTreatDotsAsLiterals:
          type: boolean
          title: Treat dots as literals
          description: Treat dots in dimension names as literals. This is useful for
            top-level dimensions that contain dots, such as 'service.name'.
        flushOnInputClose:
          type: boolean
          title: Flush on stream close
          description: Flush aggregations when an input stream is closed. If disabled,
            Time Window Settings control flush behavior.
        printUndefineds:
          type: boolean
          title: Print undefined as null
          description: When enabled (e.g. for Cribl Search), convert undefined expression
            results to null so requested-but-missing fields appear in JSON
            output. When disabled (default), undefined is preserved.
        lagTolerance:
          type: string
          title: Lag tolerance
          description: The tumbling window tolerance to late events. Must be a valid time
            string (such as 10s).
          pattern: \d+[sm]$
        idleTimeLimit:
          type: string
          title: Idle bucket time limit
          description: How long to wait before flushing a bucket that has not received
            events. Must be a valid time string (such as 10s).
          pattern: \d+[sm]$
    FunctionAggregation:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - aggregation
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaAutoTimestamp:
      type: object
      additionalProperties: false
      properties:
        srcField:
          title: Source field
          description: Field to search for a timestamp
          type: string
        dstField:
          title: Destination field
          description: Field to place timestamp in
          type: string
        defaultTimezone:
          type: string
          title: Default timezone
          description: Timezone to assign to timestamps without timezone info
        timeExpression:
          title: Time expression
          description: Expression to use to format time. Current time, as a JavaScript
            Date object, is in global `time`. You can access other fields'
            values via __e.<fieldName>.
          type: string
        offset:
          title: Start scan offset
          description: The offset into the string from which to look for a timestamp
          type: number
          minimum: 0
        maxLen:
          title: Max timestamp scan depth
          description: Maximum string length at which to look for a timestamp
          type: number
          minimum: 1
        defaultTime:
          title: Default time
          description: How to set the time field if no timestamp is found
          type: string
          enum:
            - now
            - last
            - none
          x-speakeasy-enum-descriptions:
            - Current Time
            - Last Event's Time
            - None
          x-speakeasy-unknown-values: allow
        latestDateAllowed:
          title: Future timestamp allowed
          description: The latest timestamp value allowed relative to now, such as
            +42days. Parsed values after this date will be set to the Default
            time.
          type: string
        spacer:
          type: string
        earliestDateAllowed:
          title: Earliest timestamp allowed
          description: The earliest timestamp value allowed relative to now, such as
            -42years. Parsed values prior to this date will be set to the
            Default time.
          type: string
        timestamps:
          title: Additional timestamps
          description: Add regex/strptime pairs to extract additional timestamp formats
          type: array
          items:
            type: object
            required:
              - regex
              - strptime
            properties:
              regex:
                type: string
                title: Regex
                description: Regex with first capturing group matching the timestamp
              strptime:
                type: string
                title: Strptime format
                description: Select or enter strptime format for the captured timestamp
    FunctionAutoTimestamp:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - auto_timestamp
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaCef:
      type: object
      additionalProperties: false
      properties:
        outputField:
          title: Output field
          description: The field to which the CEF formatted event will be output
          type: string
        header:
          title: Header Fields
          description: Set of header key/value pairs
          type: array
          items:
            type: object
            required:
              - value
            properties:
              name:
                type: string
                title: Name
                readOnly: true
              value:
                type: string
                title: Value Expression
                description: JavaScript expression to compute the value (can be constant)
        extension:
          title: Extension Fields
          description: Set of extension key-value pairs
          type: array
          items:
            type: object
            required:
              - name
              - value
            properties:
              name:
                type: string
                title: Name
                pattern: ^[a-zA-Z0-9]+$
              value:
                type: string
                title: Value Expression
                description: JavaScript expression to compute the value (can be constant)
    FunctionCef:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - cef
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaChain:
      type: object
      properties:
        processor:
          title: Processor
          description: The data processor (Pack/Pipeline) to send events through
          type: string
    FunctionChain:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - chain
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaClone:
      type: object
      properties:
        clones:
          type: array
          title: Clones
          description: Create clones with the following fields set
          minItems: 1
          items:
            type: object
            title: Fields
            description: Key-value pairs to set or overwrite in the clone
            additionalProperties:
              type: string
    FunctionClone:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - clone
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaCode:
      type: object
      additionalProperties: false
      properties:
        code:
          type: string
          title: Code
          description: "Caution: This Function will be evaluated in an unprotected
            context. This means that you will be able to execute almost any
            JavaScript code."
        maxNumOfIterations:
          type: number
          title: Iteration limit
          description: The maximum number of allowed iterations within this Function.
            Defaults to 5,000.
          minimum: 1
          maximum: 100000
        activeLogSampleRate:
          type: number
          title: Error log sample rate
          description: Rate at which this Function logs errors. For example, a value of 1
            logs every error, a value of 1000 (the default) logs every
            thousandth error, and so on.
          minimum: 1
          maximum: 5000
        useUniqueLogChannel:
          type: boolean
          title: Use unique log channel
          description: Logs from this Function will be sent to a unique channel in the
            form `func:code:${pipelineName}:${functionIndex}`. Disable to use
            the generic `func:code` log channel instead.
    FunctionCode:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - code
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaComment:
      type: object
      properties:
        comment:
          type: string
          title: Comment
          description: Optional, short description of this Function's purpose in the
            Pipeline
          maxLength: 1000
    FunctionComment:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - comment
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaDistinct:
      type: object
      title: distinct configuration
      properties:
        groupBy:
          type: array
          title: Grouping properties
          description: Defines the properties that are concatenated to produce distinct key
          minItems: 1
          items:
            type: string
        maxCombinations:
          type: number
          description: maximum number of tracked combinations
        maxDepth:
          type: number
          description: maximum number of groupBy properties
        isFederated:
          type: boolean
          description: indicator that the operator runs on a federated executor
        suppressPreviews:
          type: boolean
          title: Suppress preview results
          description: Toggle this on to suppress generating previews of intermediate
            results
    FunctionDistinct:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - distinct
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaDnsLookup:
      type: object
      additionalProperties: true
      properties:
        dnsLookupFields:
          title: DNS lookup fields
          description: List of field names on which to perform DNS lookup
          type: array
          items:
            type: object
            properties:
              inFieldName:
                type: string
                title: Lookup field name
              resourceRecordType:
                title: Resource record type
                description: The DNS record type (RR) to return. Defaults to 'A'.
                type: string
                enum:
                  - A
                  - AAAA
                  - ANY
                  - CNAME
                  - MX
                  - NAPTR
                  - NS
                  - PTR
                  - SOA
                  - SRV
                  - TXT
                x-speakeasy-enum-descriptions:
                  - A
                  - AAAA
                  - ANY
                  - CNAME
                  - MX
                  - NAPTR
                  - NS
                  - PTR
                  - SOA
                  - SRV
                  - TXT
                x-speakeasy-unknown-values: allow
              outFieldName:
                type: string
                title: Output field name
                description: Name of field to add lookup results to. Leave blank to overwrite
                  the lookup field.
        reverseLookupFields:
          title: Reverse DNS lookup fields
          description: List of field names on which to perform reverse DNS lookup
          type: array
          items:
            type: object
            properties:
              inFieldName:
                type: string
                title: Lookup field name
                description: Name of the field containing the IP to look up. If the field value
                  is not in IPv4 or IPv6 format, the lookup is skipped.
              outFieldName:
                type: string
                title: Output field name
                description: Name of field to add the resolved domain to. Leave blank to
                  overwrite the lookup field.
        dnsServers:
          title: DNS server overrides
          description: "IPs, in RFC 5952 format, of the DNS servers to use for resolution.
            Examples: IPv4 1.1.1.1, 4.2.2.2:53, or IPv6 [2001:4860:4860::8888],
            [2001:4860:4860::8888]:1053. If not specified, system's DNS will be
            used."
          type: array
          items:
            type: string
        cacheTTL:
          type: number
          title: Cache time to live (minutes)
          description: How frequently to expire and refetch DNS cache. Use 0 to disable.
        maxCacheSize:
          type: number
          title: Cache size limit
          description: The maximum number of DNS resolutions to be cached locally. Leave
            at default unless you understand the implications of changing.
          maximum: 100000
        useResolvConf:
          title: Use /etc/resolv.conf
          description: Attempt to resolve DNS short names using the search or domain
            directive from /etc/resolv.conf
          type: boolean
        lookupFallback:
          title: Fall back to DNS.lookup()
          description: "If unable to resolve a DNS short name, make a DNS.lookup() call to
            resolve it. Caution: This might degrade performance in unrelated
            areas of @{product}."
          type: boolean
        domainOverrides:
          title: Use search or domain fallbacks
          description: Specify fallback values for the DNS resolver to use when it cannot
            resolve a DNS short name
          type: array
          items:
            type: string
            title: fallback
        lookupFailLogLevel:
          title: Log level for failed lookups
          type: string
          enum:
            - silly
            - debug
            - info
            - warn
            - error
          x-speakeasy-enum-descriptions:
            - silly
            - debug
            - info
            - warn
            - error
          x-speakeasy-unknown-values: allow
    FunctionDnsLookup:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - dns_lookup
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaDrop:
      type: object
    FunctionDrop:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - drop
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaDropDimensions:
      type: object
      properties:
        timeWindow:
          pattern: \d+[sm]$
          type: string
          title: Aggregation time window
          description: The time span of the tumbling window for aggregating events. Must
            be a valid time string (such as 10s).
        dropDimensions:
          type: array
          title: Dimensions to drop
          description: "One or more dimensions to be dropped. Supports wildcard
            expressions. Warning: Using wildcard '*' causes all dimensions in
            the event to be dropped."
          minItems: 1
          items:
            type: string
        flushOnInputClose:
          type: boolean
          title: Flush on stream close
          description: Flush aggregations when an input stream is closed. If disabled,
            aggregations are flushed based on Time Window Settings instead.
    FunctionDropDimensions:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - drop_dimensions
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaDynamicSampling:
      type: object
      additionalProperties: false
      properties:
        mode:
          title: Sample mode
          type: string
          description: "Defines how sample rate will be derived: log(previousPeriodCount)
            or sqrt(previousPeriodCount)"
          enum:
            - log
            - sqrt
          x-speakeasy-enum-descriptions:
            - Logarithmic
            - Square Root
          x-speakeasy-unknown-values: allow
        keyExpr:
          title: Sample group key
          description: Expression used to derive sample group key.
            Example:`${domain}:${status}`. Each sample group will have its own
            derived sampling rate based on volume. Defaults to `${host}`.
          type: string
        samplePeriod:
          title: Sample period
          description: How often (in seconds) sample rates will be adjusted
          type: number
        minEvents:
          title: Minimum events
          description: Minimum number of events that must be received in previous sample
            period for sampling mode to be applied to current period. If the
            number of events received for a sample group is less than this
            minimum, a sample rate of 1:1 is used.
          type: number
        maxSampleRate:
          title: Sampling rate limit
          description: Maximum sampling rate. If computed sampling rate is above this
            value, it will be limited to this value.
          type: number
          minimum: 1
    FunctionDynamicSampling:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - dynamic_sampling
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaEval:
      type: object
      additionalProperties: false
      properties:
        add:
          title: Evaluate fields
          description: Set of key-value pairs to evaluate and add/set
          type: array
          items:
            type: object
            required:
              - value
            properties:
              name:
                type: string
                title: Name
              value:
                type: string
                title: Value Expression
                description: JavaScript expression to compute the value (can be constant)
              disabled:
                type: boolean
                description: Set to No to disable the evaluation of an individual expression
        keep:
          title: Keep fields
          description: List of fields to keep. Supports * wildcards. Takes precedence over
            'Remove fields'.
          type: array
          items:
            type: string
        remove:
          title: Remove fields
          description: List of fields to remove. Supports * wildcards. Fields that match
            'Keep fields' will not be removed. Enclose field names containing
            special characters in single or double quotes.
          type: array
          items:
            type: string
        printUndefineds:
          type: boolean
          title: Print undefined as null
          description: When enabled (e.g. for Cribl Search), convert undefined expression
            results to null so requested-but-missing fields appear in JSON
            output. When disabled (default), undefined is preserved.
    FunctionEval:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - eval
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaEventBreaker:
      type: object
      properties:
        existingOrNew:
          title: Existing or new?
          type: string
          enum:
            - existing
            - new
          x-speakeasy-enum-descriptions:
            - Use Existing
            - Create New
          x-speakeasy-unknown-values: allow
        shouldMarkCriblBreaker:
          type: boolean
          title: Add to cribl_breaker
          description: Add this Function name to the cribl_breaker field
        ruleType:
          $ref: "#/components/schemas/EventBreakerTypeOptionsEventBreakerExistingOrNewNew"
        maxEventBytes:
          type: number
          title: Event byte limit
          description: The maximum number of bytes that an event can be before being
            flushed to the Pipelines
          minimum: 1
          maximum: 134217728
        timestampAnchorRegex:
          type: string
          title: Timestamp anchor
          description: Regex to match before attempting timestamp extraction. Use $ (end
            of string anchor) to not perform extraction.
        timestamp:
          $ref: "#/components/schemas/TimestampFormatTypeEventBreakerExistingOrNewNew"
        timestampTimezone:
          type: string
          title: Default timezone
          description: Timezone to assign to timestamps without timezone info
        timestampEarliest:
          title: Earliest timestamp allowed
          description: The earliest timestamp value allowed relative to now, such as
            -42years. Parsed values prior to this date will be set to current
            time.
          type: string
        timestampLatest:
          title: Future timestamp allowed
          description: The latest timestamp value allowed relative to now, such as
            +42days. Parsed values after this date will be set to current time.
          type: string
        existingRule:
          type: string
          title: Existing ruleset
          minLength: 1
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/EventBreakerExistingOrNewNew"
            - $ref: "#/components/schemas/EventBreakerExistingOrNewExisting"
          discriminator:
            propertyName: existingOrNew
            mapping:
              new: "#/components/schemas/EventBreakerExistingOrNewNew"
              existing: "#/components/schemas/EventBreakerExistingOrNewExisting"
    FunctionEventBreaker:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - event_breaker
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaEventstats:
      type: object
      title: eventstats configuration
      properties:
        aggregations:
          type: array
          title: Aggregates
          description: Aggregate function(s) to perform on events. E.g.,
            sum(bytes).where(action=='REJECT').as(TotalBytes)
          minItems: 1
          items:
            type: string
        groupBys:
          type: array
          title: Group by fields
          description: Fields to group aggregates by, supports wildcard expressions.
          items:
            type: string
        maxEvents:
          type: number
          title: Maximum number of events
          description: Specifies how many events are at max kept in memory to be enriched
            with aggregations
        flushOnInputClose:
          type: boolean
          title: Flush on stream close
          description: Determines if aggregations should flush when an input stream is
            closed. If disabled, time window settings will control flush
            behavior.
    FunctionEventstats:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - eventstats
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaExternaldata:
      type: object
    FunctionExternaldata:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - externaldata
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaFlatten:
      type: object
      properties:
        fields:
          type: array
          title: Fields
          description: List of top-level fields to include for flattening. Supports *
            wildcards, except when used on internal fields. Defaults to empty
            array, which means all fields.
          items:
            type: string
            pattern: ^(?!__.*\*).*$
        prefix:
          type: string
          title: Prefix
          description: Prefix string for flattened field names. Defaults to empty.
        depth:
          type: number
          title: Depth
          description: Number representing the nested levels to consider for flattening.
            Defaults to 5. Minimum should be 1.
          minimum: 1
        delimiter:
          type: string
          title: Delimiter
          description: Delimiter to be used for flattening. Defaults to underscore.
    FunctionFlatten:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - flatten
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaFoldkeys:
      type: object
      properties:
        deleteOriginal:
          title: Delete original
          description: When enabled (default), only the folded keys are kept. When
            disabled, the original entries are retained alongside the folded
            keys.
          type: boolean
        separator:
          title: Separator string
          description: Character or string used to separate key levels to be folded.
            Defaults to the dot (.) character.
          type: string
        selectionRegExp:
          title: Selection regular expression
          description: Optional regular expression to select a subset of the keys to fold.
          type: string
        maxDepth:
          title: Maximum depth
          description: Maximum recursion depth when traversing nested objects. Prevents
            infinite loops caused by cyclic references. Defaults to 20.
          type: integer
          minimum: 1
    FunctionFoldkeys:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - foldkeys
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaGenStats:
      type: object
      title: Gen stats configuration
      additionalProperties: false
      properties:
        fields:
          type: array
          items:
            type: string
    FunctionGenStats:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - gen_stats
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaGeoip:
      type: object
      additionalProperties: false
      properties:
        file:
          type: string
          title: GeoIP file (.mmdb)
          description: Select an uploaded Maxmind database, or specify path to a Maxmind
            database with .mmdb extension
          minLength: 1
        inField:
          type: string
          title: IP field
          description: Field name in which to find an IP to look up. Can be nested.
        outField:
          type: string
          title: Result field
          description: Field name in which to store the GeoIP lookup results
        additionalFields:
          type: array
          title: Additional fields
          items:
            type: object
            required:
              - extraInField
              - extraOutField
            properties:
              extraInField:
                type: string
                title: IP Field
                description: Field name in which to find an IP to look up. Can be nested.
              extraOutField:
                type: string
                title: Result Field
                description: Field name in which to store the GeoIP lookup results
        outFieldMappings:
          type: object
          title: Output field mappings
          description: Search-specific mappings for granular control over event enrichment
    FunctionGeoip:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - geoip
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaGrok:
      type: object
      properties:
        pattern:
          type: string
          title: Pattern
          description: "Grok pattern to extract fields. Syntax supported:
            %{PATTERN_NAME:FIELD_NAME}"
        patternList:
          type: array
          title: Additional Grok patterns
          items:
            $ref: "#/components/schemas/PatternListConfSerdeTypeGrok"
        source:
          type: string
          title: Source field
          description: Field on which to perform Grok extractions
    FunctionGrok:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - grok
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaHandlebars:
      type: object
      properties:
        templates:
          type: array
          title: Templates
          description: Array of template definitions. Uses event.__template_id to select
            template at runtime.
          items:
            type: object
            title: Template definition
            required:
              - id
              - content
              - type
            additionalProperties: false
            properties:
              id:
                type: string
                title: Template ID
                description: Unique identifier for this template
                minLength: 1
              content:
                type: string
                title: Template content
                description: Handlebars template string
                minLength: 1
              description:
                type: string
                title: Description
                description: Optional description of what this template is used for
              type:
                type: string
                title: Template type
                description: Type categorization for the template (e.g., Universal, Email,
                  Slack)
        targetField:
          type: string
          title: Target field
          description: Field name to store the rendered template result. Defaults to _raw.
        parseJson:
          type: boolean
          title: Parse as JSON
          description: Parse the rendered template as JSON and store as an object instead
            of a string. Useful for building structured data like Slack blocks.
        removeOnNull:
          type: boolean
          title: Remove field if empty
          description: Remove the target field if the rendered result is empty or null.
    FunctionHandlebars:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - handlebars
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaJoin:
      type: object
      title: Join Configuration
      additionalProperties: false
      properties:
        kind:
          type: string
          title: Kind
          description: Join kind, e.g. inner
        hints:
          type: object
          title: Hint
          description: Hints passed to the join function
          additionalProperties:
            type: string
        fieldConditions:
          title: Join Conditions
          description: Fields to use when joining
          type: array
          minItems: 1
          items:
            type: object
            required:
              - leftFieldName
              - rightFieldName
            properties:
              leftFieldName:
                title: Left Field Name
                description: The field name to join on, on the left side.
                type: string
              rightFieldName:
                title: Right Field Name
                description: The field name on the right side of the data, i.e. the stage
                  results, that we are joining with
                type: string
        searchJobId:
          title: Search Job Id
          description: The id for this search job.
          type: string
        stageId:
          title: Stage Id
          description: The stage we are joining with.
          type: string
    FunctionJoin:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - join
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaJsonUnroll:
      type: object
      properties:
        path:
          type: string
          title: Path
          description: Path to array to unroll, such as foo.0.bar
        name:
          type: string
          title: New name
          description: Name of each exploded array element in each new event. Leave empty
            to expand the array element with its original name.
    FunctionJsonUnroll:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - json_unroll
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaLakeExport:
      type: object
      title: Lake export Configuration
      additionalProperties: false
      properties:
        searchJobId:
          title: Search Job Id
          description: Id of the search job this function is running on.
          type: string
        dataset:
          title: Dataset Name
          description: Name of the dataset
          type: string
        lake:
          title: Lake Name
          description: Name of the lake
          type: string
        tee:
          title: Tee
          description: Tee results to search. When set to true results will be shipped
            instead of stats
          type: boolean
        flushMs:
          title: Flush period
          description: How often are stats flushed in ms
          type: number
        suppressPreviews:
          type: boolean
          title: Suppress periodic stats
          description: Disables generation of intermediate stats. When true stats will be
            emitted only on end
    FunctionLakeExport:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - lake_export
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaLimit:
      type: object
      additionalProperties: false
      properties:
        limit:
          title: Event limit
          description: Number of qualifying events to pass through
          type: integer
          minimum: 0
    FunctionLimit:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - limit
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaLocalSearchDatatypeParser:
      type: object
    FunctionLocalSearchDatatypeParser:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - local_search_datatype_parser
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaLocalSearchRulesetRunner:
      type: object
      additionalProperties: false
      properties:
        rulesetType:
          type: string
          enum:
            - dataset
            - datatype
          title: Ruleset Type
          x-speakeasy-unknown-values: allow
        rulesetId:
          type: string
          title: Ruleset ID
        ruleset:
          type: object
          title: Full ruleset, i.e. for use with live data capture, which uses
            draft/unsaved rulesets
        markAndIncludeDroppedEvents:
          type: boolean
          title: Mark and include dropped events
          description: Only for use with live data capture. Mark events that were dropped
            by dataset rules and still include them for capture
    FunctionLocalSearchRulesetRunner:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - local_search_ruleset_runner
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaLocalSearchSchemaMapper:
      type: object
    FunctionLocalSearchSchemaMapper:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - local_search_schema_mapper
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaLocalSearchTimeRangeNormalizer:
      type: object
    FunctionLocalSearchTimeRangeNormalizer:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - local_search_time_range_normalizer
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaLocalSearchTransformer:
      type: object
    FunctionLocalSearchTransformer:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - local_search_transformer
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaLookup:
      type: object
      properties:
        file:
          type: string
          title: Lookup file path (.csv, .csv.gz)
          description: "Path to the lookup file. Reference environment variables via $.
            Example: $HOME/file.csv"
          minLength: 1
        dbLookup:
          type: boolean
          title: Use Disk-Based Lookup
          description: Enable to use a disk-based lookup. This option displays only the
            settings relevant to disk-based mode and hides those for in-memory
            lookups.
        matchMode:
          title: Match mode
          type: string
          description: Specifies the matching method based on the format and logic used in
            the lookup file
          enum:
            - exact
            - cidr
            - regex
          x-speakeasy-enum-descriptions:
            - Exact
            - CIDR
            - Regex
          x-speakeasy-unknown-values: allow
        matchType:
          title: Match type
          type: string
          description: "Further defines how to handle multiple matches: return the first
            match, the most specific match, or all matches"
          enum:
            - first
            - specific
            - all
          x-speakeasy-unknown-values: allow
        reloadPeriodSec:
          type: number
          title: Reload period (sec)
          description: Checks the lookup file periodically for changes and reloads it if
            modified. Set to -1 to disable reloading (default). Useful for
            lookups not managed by Stream or not updated by an external process.
            [Learn
            more](https://docs.cribl.io/stream/lookup-function/#advanced-settings)
        inFields:
          type: array
          title: Lookup fields
          description: Fields that should be used to key into the lookup table
          minItems: 1
          items:
            type: object
            required:
              - eventField
            properties:
              eventField:
                type: string
                title: Lookup Field Name in Event
                description: Field name as it appears in events
                pattern: ^[a-zA-Z$_'"][a-zA-Z0-9$_\[\]\.'"]*$
              lookupField:
                type: string
                title: Corresponding Field Name in Lookup
                description: "Optional: The field name as it appears in the lookup file.
                  Defaults to event field name"
        outFields:
          type: array
          title: Output fields
          description: Fields to add to events after matching lookup. Defaults to all if
            not specified.
          items:
            type: object
            required:
              - lookupField
            properties:
              lookupField:
                type: string
                title: Output Field Name from Lookup
                description: The field name as it appears in the lookup file
              eventField:
                type: string
                title: Lookup Field Name in Event
                description: "Optional: Field name to add to event. Defaults to lookup field
                  name."
                pattern: ^[a-zA-Z$_][a-zA-Z0-9$_\[\]\.'"]*$
              defaultValue:
                type: string
                title: Default Value
                description: "Optional: Value to assign if lookup entry is not found"
        addToEvent:
          type: boolean
          title: Add to raw event
          description: Add the looked-up values to _raw, as key=value pairs
        ignoreCase:
          type: boolean
          title: Ignore case
          description: "Whether to ignore case when performing lookups using Match Mode:
            Regex."
    FunctionLookup:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - lookup
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaMask:
      type: object
      properties:
        rules:
          type: array
          title: Masking rules
          minItems: 1
          items:
            type: object
            required:
              - matchRegex
              - replaceExpr
            properties:
              matchRegex:
                type: string
                title: Match Regex
                description: Pattern to replace. Use /g to replace all matches.
                minLength: 1
              replaceExpr:
                type: string
                title: Replace Expression
                description: A JavaScript expression or literal to replace the matching content.
                  Capturing groups can be referenced as g1, g2, and so on, and
                  event fields as event.<fieldName>.
              disabled:
                type: boolean
                description: Set to No to disable the evaluation of an individual rule
        fields:
          type: array
          title: Apply to fields
          description: Fields on which to apply the masking rules. Supports * wildcards,
            except when used on internal fields.
          items:
            type: string
            pattern: ^(?!__.*\*).*$
        depth:
          type: integer
          title: Depth
          description: Depth to which the Mask Function will search for fields to mask
          minimum: 1
        flags:
          title: Evaluate fields
          description: Fields to evaluate if one or more masking rules are matched
          type: array
          items:
            $ref: "#/components/schemas/AddConfFunctionConfSchemaAggregation"
    FunctionMask:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - mask
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaMvExpand:
      type: object
      additionalProperties: false
      properties:
        sourceFields:
          title: Source fields
          description: Array of property-/field-names to expand
          type: array
          minItems: 1
          items:
            type: string
        targetNames:
          title: Target field names
          description: stores the value as new target field name
          type: array
          minItems: 1
          items:
            type: string
        rowLimit:
          title: Row limit
          description: max. number of rows generated out of every source events
          type: number
        itemIndexName:
          title: Item index name
          description: name of an optional index property generated into the output
          type: string
        bagExpansionMode:
          title: Bag expansion mode
          description: decides if bag-values are expanded to bags or arrays
          type: string
          enum:
            - bag
            - array
          x-speakeasy-enum-descriptions:
            - Store as object
            - Store as array
          x-speakeasy-unknown-values: allow
    FunctionMvExpand:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - mv_expand
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaMvPull:
      type: object
      additionalProperties: false
      properties:
        arrayPath:
          title: Field name of source array
          description: Field name of the array within events that contains the data
            objects of interest. Can be a path.
          type: string
        relativeKeyPath:
          title: Field name of key
          description: Extract the K-V pair's key from this field, relative to the data
            object.
          type: string
        relativeValuePath:
          title: Field name of value
          description: Extract the K-V pair's value from this field, relative to the data
            object.
          type: string
        targetBagPath:
          title: Field name for pulled fields
          description: Optionally, specify a bag as the target for K-V entries. If not
            specified, these entries are stored on each top-level event.
          type: string
        deleteOriginal:
          title: Delete source array after processing
          description: Toggle this on to remove each original array of data objects after
            extraction. If toggled off, arrays are retained.
          type: boolean
    FunctionMvPull:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - mv_pull
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaNotificationPolicies:
      type: object
      title: Notification Policies Configuration
      properties:
        policies:
          type: array
          title: Policies
          description: List of notification routing policies evaluated in order
          items:
            type: object
            required:
              - id
              - templateTargetPairs
              - order
            properties:
              id:
                type: string
                title: Policy ID
                description: Unique identifier for this policy
                minLength: 1
              disabled:
                type: boolean
                title: Disabled
                description: If true, this policy will be skipped during evaluation
              waitToGroup:
                type: number
                title: Wait to Group (Minutes)
                description: Time to wait (in minutes) to group similar alerts before sending
                minimum: 0
              groupByLabels:
                type: array
                title: Group By Labels
                description: Event fields to use for grouping
                items:
                  type: string
              conditions:
                type: array
                title: OR Conditions
                description: List of conditions. If ANY condition matches (OR), the policy
                  applies. Each condition is a list of tags that must ALL match
                  (AND).
                items:
                  type: array
                  title: AND Group
                  items:
                    type: object
                    required:
                      - key
                      - operator
                      - value
                    properties:
                      key:
                        type: string
                        title: Field Name
                        description: Event field name to match against
                        minLength: 1
                      operator:
                        type: string
                        title: Operator
                        description: Comparison operator
                        enum:
                          - =
                          - "!="
                          - =~
                          - "!~"
                        x-speakeasy-enums:
                          - Equal
                          - NotEqual
                          - RegexMatch
                          - RegexNotMatch
                        x-speakeasy-unknown-values: allow
                      value:
                        title: Value
                        description: Value to compare against (string, number, boolean)
                        oneOf:
                          - type: string
                          - type: number
                          - type: boolean
              templateTargetPairs:
                type: array
                title: Template & Target Pairs
                description: List of targets to route to and the templates to use
                minItems: 1
                items:
                  $ref: "#/components/schemas/TemplateTargetPairConfFunctionConfSchemaNotificatio\
                    nPolicies"
              final:
                type: boolean
                title: Final
                description: If true, stop evaluating further policies after this one matches
              order:
                type: number
                title: Order
                description: Evaluation order of this policy (lower numbers evaluated first)
                minimum: 0
    FunctionNotificationPolicies:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - notification_policies
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaNotifications:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          title: ID
          description: Notification ID
        field:
          type: string
          title: Field
          description: Notification event state field name
        deduplicate:
          type: boolean
          title: Deduplicate
          description: Toggle deduplication.
    FunctionNotifications:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - notifications
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaNotify:
      type: object
      title: Notify Configuration
      additionalProperties: false
      properties:
        group:
          title: Group
          description: Group the notification belongs to
          type: string
        notificationId:
          title: Workspace
          description: Workspace within the deployment to send the search results to.
          type: string
        searchId:
          title: Search Id
          description: Id of the search this function is running on.
          type: string
        savedQueryId:
          title: Saved query Id
          description: Id of the saved query
          type: string
        trigger:
          title: Trigger condition expression
          description: Js expression that filters events, a greater than 'Trigger Count'
            events will trigger the notification
          type: string
        triggerType:
          type: string
          title: Trigger type
          description: Type of the trigger condition. custom applies a kusto expression
            over the results, and results count applies a comparison over
            results count
          enum:
            - custom
            - resultsCount
          x-speakeasy-enum-descriptions:
            - Where
            - Count of Results
          x-speakeasy-unknown-values: allow
        triggerComparator:
          type: string
          title: Count comparator
          description: Operation to be applied over the results count
          enum:
            - ">"
            - <
            - ===
            - "!=="
            - ">="
            - <=
          x-speakeasy-enum-descriptions:
            - greater than
            - less than
            - equals
            - not equal to
            - greater than or equal to
            - less than or equal to
          x-speakeasy-unknown-values: allow
        triggerCount:
          title: Trigger Count
          description: How many results that match trigger the condition
          type: number
        resultsLimit:
          title: Top number results
          description: Number of results to include in the notification event
          type: number
        searchUrl:
          title: Search url
          description: Url of the search results
          type: string
        message:
          title: Message content
          description: "Message content template, available fields: searchId, resultSet,
            savedQueryId, notificationId, searchResultsUrl"
          type: string
        authToken:
          title: Api Auth Token
          description: Auth token for sending notification messages
          type: string
        messagesEndpoint:
          title: Messages api endpoint
          description: System messages api endpoint
          type: string
        tenantId:
          title: Tenant Id
          description: Current tenant id
          type: string
    FunctionNotify:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - notify
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaNumerify:
      type: object
      properties:
        depth:
          type: integer
          title: Depth
          description: Depth to which the Numerify Function will search within a nested
            event. Depth greater than 5 (the default) could decrease
            performance.
          minimum: 0
          maximum: 10
        ignoreFields:
          title: Ignore fields
          description: "Fields to NOT numerify. Takes precedence over 'Include expression'
            when set. Supports wildcards. A '!' before field name(s) means:
            numerify all fields EXCEPT these. For syntax details, see
            [Wildcard Lists](https://docs.cribl.io/stream/introduction-referenc\
            e/#wildcard-lists)."
          type: array
          items:
            type: string
            description: Field to ignore
        filterExpr:
          title: Include expression
          description: "Optional JavaScript expression to determine whether a field should
            be numerified. If left blank, all fields will be numerified. Use the
            'name' and 'value' global variables to access fields' names/values.
            Examples: `value != null`, `name=='fieldname'`. You can access other
            fields' values via `__e.<fieldName>`."
          type: string
        format:
          title: Format
          type: string
          enum:
            - none
            - fix
            - floor
            - ceil
          x-speakeasy-enum-descriptions:
            - None
            - Fix
            - Floor
            - Ceil
          x-speakeasy-unknown-values: allow
        digits:
          type: number
          title: Digits
          description: Number of digits after the decimal point, between 0 and 20. If left
            blank, defaults to 2.
          minimum: 0
          maximum: 20
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/NumerifyFormatFix"
            - $ref: "#/components/schemas/NumerifyFormatNone"
          discriminator:
            propertyName: format
            mapping:
              fix: "#/components/schemas/NumerifyFormatFix"
              none: "#/components/schemas/NumerifyFormatNone"
    FunctionNumerify:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - numerify
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaOtlpLogs:
      type: object
      properties:
        dropNonLogEvents:
          type: boolean
          title: Drop non-log events
        batchOTLPLogs:
          type: boolean
          title: Batch OTLP logs
          description: Batch OTLP log records by shared top-level `resource` attributes
        sendBatchSize:
          type: number
          title: Batch size
          description: Number of log records after which a batch will be sent, regardless
            of the timeout
        timeout:
          type: number
          title: Batch timeout (ms)
          description: Time duration after which a batch will be sent, regardless of size
        sendBatchMaxSize:
          type: number
          title: Batch size limit (kb)
          description: Maximum batch size. Enter 0 for no maximum.
        metadataKeys:
          type: array
          title: Batch log metadata keys
          description: When set, this processor will create one batcher instance per
            distinct combination of values in the metadata
        metadataCardinalityLimit:
          type: number
          title: Metadata cardinality limit
          description: "Limit the number of unique combinations of metadata key values
            that will be processed over the lifetime of the process. After the
            limit is reached, events with new metadata key value combinations
            will be dropped. "
    FunctionOtlpLogs:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - otlp_logs
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaOtlpMetrics:
      type: object
      properties:
        resourceAttributePrefixes:
          type: array
          title: Resource attribute prefixes
          description: The prefixes of top-level attributes to add as resource attributes.
            Each attribute must match the regex pattern `^[a-zA-Z0-9_\.]+$`. Use
            Eval to copy nested attributes to the top level for matching.
          items:
            type: string
            pattern: ^[a-zA-Z0-9_\.]+$
        dropNonMetricEvents:
          type: boolean
          title: Drop non-metric events
        otlpVersion:
          $ref: "#/components/schemas/OtlpVersionOptions"
        batchOTLPMetrics:
          type: boolean
          title: Batch OTLP metrics
          description: Batch OTLP metrics by shared top-level `resource` attributes
        sendBatchSize:
          type: number
          title: Batch size
          description: Number of metric data points after which a batch will be sent,
            regardless of the timeout
        timeout:
          type: number
          title: Batch timeout (ms)
          description: Time duration after which a batch will be sent, regardless of size
        sendBatchMaxSize:
          type: number
          title: Batch size limit (kb)
          description: Maximum batch size. Enter 0 for no maximum.
        metadataKeys:
          type: array
          title: Batch metrics metadata keys
          description: When set, this processor will create one batcher instance per
            distinct combination of values in the metadata
        metadataCardinalityLimit:
          type: number
          title: Metadata cardinality limit
          description: Limit the number of unique combinations of metadata key values that
            will be processed over the lifetime of the process. After the limit
            is reached, events with new metadata key value combinations will be
            dropped.
    FunctionOtlpMetrics:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - otlp_metrics
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaOtlpTraces:
      type: object
      properties:
        dropNonTraceEvents:
          type: boolean
          title: Drop non-trace events
        otlpVersion:
          $ref: "#/components/schemas/OtlpVersionOptions"
        batchOTLPTraces:
          type: boolean
          title: Batch OTLP traces
          description: Batch OTLP traces by shared top-level `resource` attributes
        sendBatchSize:
          type: number
          title: Batch size
          description: Number of spans after which a batch will be sent, regardless of the
            timeout
        timeout:
          type: number
          title: Batch timeout (ms)
          description: Time duration after which a batch will be sent, regardless of size
        sendBatchMaxSize:
          type: number
          title: Batch size limit (kb)
          description: Maximum batch size. Enter 0 for no maximum.
        metadataKeys:
          type: array
          title: Batch traces metadata keys
          description: When set, this processor will create one batcher instance per
            distinct combination of values in the metadata
        metadataCardinalityLimit:
          type: number
          title: Metadata cardinality limit
          description: Limit the number of unique combinations of metadata key values that
            will be processed over the lifetime of the process. After the limit
            is reached, events with new metadata key value combinations will be
            dropped.
    FunctionOtlpTraces:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - otlp_traces
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaPack:
      type: object
      properties:
        unpackedFields:
          title: Unpacked fields
          description: List of fields to keep, everything else will be packed
          type: array
          items:
            type: string
        target:
          type: string
          title: Packed target Field
          description: Name of the (packed) target field
    FunctionPack:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - pack
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaPivot:
      type: object
      title: Simple Pivot Configuration
      additionalProperties: false
      properties:
        labelField:
          title: Labeling field
          description: Fields to be used for the left-most column.
          type: string
        dataFields:
          title: Data fields
          description: Fields with the cell values (i.e. aggregates)
          type: array
          minItems: 1
          items:
            type: string
        qualifierFields:
          title: Qualifier fields
          description: Fields to qualify or group data fields
          type: array
          minItems: 1
          items:
            type: string
    FunctionPivot:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - pivot
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaPublishMetrics:
      type: object
      additionalProperties: false
      properties:
        fields:
          title: Add metrics
          description: List of metrics from event to extract and format. Formatted metrics
            can be used by a destination to pass metrics to a metrics
            aggregation platform.
          type: array
          minItems: 0
          items:
            type: object
            required:
              - inFieldName
              - metricType
            properties:
              inFieldName:
                type: string
                title: Event Field Name
                description: The name of the field in the event that contains the metric value
              outFieldExpr:
                type: string
                title: Metric Name Expression
                description: JavaScript expression to evaluate the metric field name. Defaults
                  to Event Field Name.
              metricType:
                type: string
                title: Metric Type
                enum:
                  - counter
                  - timer
                  - gauge
                  - distribution
                  - summary
                  - histogram
                x-speakeasy-enum-descriptions:
                  - Counter
                  - Timer
                  - Gauge
                  - Distribution
                  - Summary
                  - Histogram
                x-speakeasy-unknown-values: allow
        overwrite:
          type: boolean
          title: Overwrite
          description: Overwrite previous metric specs. Leave disabled to append.
        dimensions:
          type: array
          title: Add dimensions
          description: Optional list of dimensions to include in events. Wildcards
            supported. If you don't specify metrics, values will be appended to
            every metric found in the event. When you add a new metric,
            dimensions will be present only in those new metrics.
          items:
            type: string
        removeMetrics:
          title: Remove metrics
          description: Optional list of metric field names to look for when removing
            metrics. When a metric's field name matches an element in this list,
            the metric will be removed from the event.
          type: array
          items:
            type: string
        removeDimensions:
          type: array
          title: Remove dimensions
          description: Optional list of dimensions to remove from every metric found in
            the event. Wildcards supported.
          items:
            type: string
    FunctionPublishMetrics:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - publish_metrics
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaRedis:
      type: object
      properties:
        commands:
          type: array
          minItems: 1
          title: Commands
          items:
            type: object
            required:
              - keyExpr
              - command
            properties:
              outField:
                title: Result field
                description: Name of the field in which to store the returned value. Leave blank
                  to discard returned value.
                type: string
              command:
                title: Command
                description: "Redis command to perform. For a complete list visit:
                  https://redis.io/commands"
                type: string
              keyExpr:
                title: Key
                description: A JavaScript expression to compute the value of the key to operate
                  on. Can also be a constant such as 'username'.
                type: string
              argsExpr:
                title: Args
                description: A JavaScript expression to compute arguments to the operation. Can
                  return an array.
                type: string
        deploymentType:
          title: Deployment type
          type: string
          description: How the Redis server is configured. Defaults to Standalone
          enum:
            - standalone
            - cluster
            - sentinel
          x-speakeasy-enum-descriptions:
            - Standalone
            - Cluster
            - Sentinel
          x-speakeasy-unknown-values: allow
        authType:
          type: string
          title: Authentication method
          enum:
            - none
            - manual
            - credentialsSecret
            - textSecret
          x-speakeasy-enum-descriptions:
            - None
            - Manual
            - User Secret
            - Admin Secret
          x-speakeasy-unknown-values: allow
        maxBlockSecs:
          type: number
          title: Blocking time limit
          description: Maximum amount of time (seconds) to wait before assuming that Redis
            is down and passing events through. Use 0 to disable.
        enableClientSideCaching:
          type: boolean
          title: Client-side cache
          description: Enable client-side cache. Redundant when using Redis write
            operations. See more options at Settings > General > Limits > Redis
            Cache.
        url:
          title: Redis URL
          description: "Redis URL to connect to. Format:
            redis[s]://[[user][:password@]][host][:port][/db-number][?db=db-num\
            ber[&password=bar[&option=value]]]. Must be a JavaScript expression
            (which can evaluate to a constant value), enclosed in quotes or
            backticks. Can be evaluated only at init time. Example referencing a
            Global Variable: `myBucket-${C.vars.myVar}`"
          type: string
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        tlsOptions:
          $ref: "#/components/schemas/TlsOptionsTypeRedisDeploymentTypeStandalone"
        rootNodes:
          title: Root nodes
          description: Root nodes to which the cluster connection should be initiated
          type: array
          minItems: 1
          items:
            $ref: "#/components/schemas/RootNodeConfRedisDeploymentTypeCluster"
        tls:
          title: TLS
          type: boolean
          description: Use TLS for connections to this cluster
        scaleReads:
          $ref: "#/components/schemas/ScaleReadsOptionsRedisDeploymentTypeCluster"
        masterName:
          title: Master group name
          type: string
        username:
          title: Username
          type: string
        __template_username:
          type: string
          description: Binds 'username' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'username' at runtime.
        password:
          title: Password
          type: string
        __template_password:
          type: string
          description: Binds 'password' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'password' at runtime.
        credentialsSecret:
          type: string
          title: User secret
          description: Secret that references Redis username and password
        textSecret:
          type: string
          title: Admin secret
          description: Secret that references Redis admin password
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/RedisDeploymentTypeStandalone"
            - $ref: "#/components/schemas/RedisDeploymentTypeCluster"
            - $ref: "#/components/schemas/RedisDeploymentTypeSentinel"
          discriminator:
            propertyName: deploymentType
            mapping:
              standalone: "#/components/schemas/RedisDeploymentTypeStandalone"
              cluster: "#/components/schemas/RedisDeploymentTypeCluster"
              sentinel: "#/components/schemas/RedisDeploymentTypeSentinel"
        - oneOf:
            - $ref: "#/components/schemas/RedisAuthTypeNone"
            - $ref: "#/components/schemas/RedisAuthTypeManual"
            - $ref: "#/components/schemas/RedisAuthTypeCredentialsSecret"
            - $ref: "#/components/schemas/RedisAuthTypeTextSecret"
          discriminator:
            propertyName: authType
            mapping:
              none: "#/components/schemas/RedisAuthTypeNone"
              manual: "#/components/schemas/RedisAuthTypeManual"
              credentialsSecret: "#/components/schemas/RedisAuthTypeCredentialsSecret"
              textSecret: "#/components/schemas/RedisAuthTypeTextSecret"
    FunctionRedis:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - redis
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaRegexExtract:
      type: object
      properties:
        regex:
          type: string
          title: Regex
          description: Regex literal with named capturing groups, such as (?<foo>bar), or
            _NAME_ and _VALUE_ capturing groups, such as (?<_NAME_0>[^
            =]+)=(?<_VALUE_0>[^,]+)
        regexList:
          type: array
          title: Additional regex
          items:
            $ref: "#/components/schemas/RegexListConfSerdeTypeRegex"
        source:
          type: string
          title: Source field
          description: Field on which to perform regex field extraction
        iterations:
          type: number
          title: Max exec
          description: The maximum number of times to apply regex to source field when the
            global flag is set, or when using _NAME_ and _VALUE_ capturing
            groups
          minimum: 1
        fieldNameExpression:
          title: Field name format expression
          description: "JavaScript expression to format field names when _NAME_n and
            _VALUE_n capturing groups are used. Original field name is in global
            variable 'name'. Example: To append XX to all field names, use
            `${name}_XX` (backticks are literal). If empty, names will be
            sanitized using this regex: /^[_0-9]+|[^a-zA-Z0-9_]+/g. You can
            access other fields values via __e.<fieldName>."
          type: string
        overwrite:
          type: boolean
          title: Overwrite existing fields
          description: Overwrite existing event fields with extracted values. If disabled,
            existing fields will be converted to an array.
    FunctionRegexExtract:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - regex_extract
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaRegexFilter:
      type: object
      properties:
        regex:
          title: Regex
          description: Regex to test against
          type: string
        regexList:
          type: array
          title: Additional regex
          items:
            type: object
            required:
              - regex
            properties:
              regex:
                type: string
                title: Regex
                description: Regex to test against
                minLength: 1
        field:
          title: Field
          description: Name of the field to apply the regex on (defaults to _raw)
          type: string
    FunctionRegexFilter:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - regex_filter
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaRename:
      type: object
      properties:
        baseFields:
          title: Parent fields
          description: Fields whose children will inherit the Rename fields and Rename
            expression operations. Supports wildcards. If empty, only top-level
            fields will be renamed.
          type: array
          items:
            type: string
        rename:
          title: Rename fields
          description: Set of key-value pairs to rename fields, where key is the current
            name and value is the new name. Does not support internal fields.
          type: array
          items:
            type: object
            required:
              - currentName
              - newName
            properties:
              currentName:
                type: string
                title: Current Name
                description: Name of the field to rename. Literal identifiers must be quoted.
                pattern: ^(?!__).+
              newName:
                type: string
                title: New Name
                description: The name the field will be renamed to. Literal identifiers must be
                  quoted.
                pattern: ^(?!__).+
        renameExpr:
          title: Rename expression
          description: "Optional JavaScript expression whose returned value will be used
            to rename fields. Use the 'name' and 'value' global variables to
            access field names/values. Example: `name.startsWith('data') ?
            name.toUpperCase() : name`. You can access other field values via
            __e.<fieldName>."
          type: string
        wildcardDepth:
          type: integer
          title: Parent field wildcard depth
          description: For wildcards specified in Parent fields, sets the maximum depth
            within events to match and rename fields. Enter `0` to match only
            top-level fields. Defaults to `5` levels down.
          minimum: 0
    FunctionRename:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - rename
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaRollupMetrics:
      type: object
      properties:
        dimensions:
          title: Dimensions
          description: List of dimensions across which to perform rollups. Supports
            wildcards. Defaults to all original dimensions.
          type: array
          items:
            type: string
        timeWindow:
          pattern: \d+[sm]$
          type: string
          title: Time window
          description: The time span of the rollup window. Must be a valid time string
            (such as 10s).
        gaugeRollup:
          title: Gauge update
          description: The operation to use when rolling up gauge metrics. Defaults to last.
          type: string
          enum:
            - last
            - max
            - min
            - avg
          x-speakeasy-enum-descriptions:
            - Last
            - Maximum
            - Minimum
            - Average
          x-speakeasy-unknown-values: allow
    FunctionRollupMetrics:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - rollup_metrics
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSampling:
      type: object
      properties:
        rules:
          type: array
          title: Sampling rules
          description: Events matching these rules will be sampled at the given rate
          items:
            type: object
            required:
              - filter
              - rate
            additionalProperties: false
            properties:
              filter:
                title: Filter
                type: string
                description: JavaScript filter expression matching events to be sampled. Use
                  true to match all.
              rate:
                title: Sampling Rate
                type: integer
                description: Sampling rate; picks one out of N matching events
    FunctionSampling:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - sampling
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSearchEngineExport:
      type: object
      title: Search engine export Configuration
      additionalProperties: false
      properties:
        searchJobId:
          title: Search Job Id
          description: Id of the search job this function is running on.
          type: string
        dataset:
          title: Dataset Id
          description: Id of the dataset
          type: string
        tee:
          title: Tee
          description: Tee results to search. When set to true results will be shipped
            instead of stats
          type: boolean
        flushMs:
          title: Flush period
          description: How often are stats flushed in ms
          type: number
        suppressPreviews:
          type: boolean
          title: Suppress periodic stats
          description: Disables generation of intermediate stats. When true stats will be
            emitted only on end
    FunctionSearchEngineExport:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - search_engine_export
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSend:
      type: object
      title: Send Configuration
      additionalProperties: false
      properties:
        url:
          title: URL
          description: Full URL to send search to.
          type: string
        group:
          title: Group
          description: Group within the workspace we're sending to.
          type: string
        workspace:
          title: Workspace
          description: Workspace within the deployment to send the search results to.
          type: string
        sendUrlTemplate:
          title: URL Template
          description: Template to build the URL to send from.
          type: string
        searchId:
          title: Search Id
          description: Id of the search this function is running on.
          type: string
        tee:
          title: Tee
          description: Tee results to search. When set to true results will be shipped
            instead of stats
          type: boolean
        flushMs:
          title: Flush period
          description: How often are stats flushed in ms
          type: number
        suppressPreviews:
          type: boolean
          title: Suppress periodic stats
          description: Disables generation of intermediate stats. When true stats will be
            emitted only on end
        mode:
          type: string
          title: Mode
          description: In Sender mode, forwards search results directly to the
            destination. In Metrics mode, accumulates metrics from federated
            send operators, and forwards the aggregate metrics.
          enum:
            - sender
            - metrics
          x-speakeasy-unknown-values: allow
    FunctionSend:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - send
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSensitiveDataScanner:
      type: object
      properties:
        rules:
          type: array
          title: Scanning Rulesets
          minItems: 1
          items:
            type: object
            required:
              - rulesetId
              - replaceExpr
            properties:
              rulesetId:
                type: string
                title: Ruleset ID
                description: The ID of the ruleset to use for the scan
              replaceExpr:
                type: string
                title: Mitigation Expression
                description: A JavaScript expression or literal to replace the matching content.
                  Capturing groups can be referenced as g1, g2, and so on, and
                  event fields as event.<fieldName>.
              disabled:
                type: boolean
        fields:
          type: array
          title: Apply to fields
          description: Rulesets act on the events contained in these fields. Mitigation
            expressions apply to the scan results. Supports wildcards (*).
          items:
            type: string
            pattern: ^(?!__.*\*).*$
        excludeFields:
          type: array
          title: Fields to ignore
          description: Fields that the mitigation expression will not be applied to.
            Supports wildcards (*).
          items:
            type: string
            pattern: ^(?!__.*\*).*$
        flags:
          title: Add fields
          description: Fields to add when mitigation is applied to an event
          type: array
          items:
            type: object
            required:
              - value
            properties:
              name:
                type: string
                title: Name
              value:
                type: string
                title: Value
        includeDetectedRules:
          type: boolean
          title: Include detected rules
          description: Add matching ruleset IDs to a field called "__detected"
        backgroundDetection:
          type: boolean
          title: Background detection
    FunctionSensitiveDataScanner:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - sensitive_data_scanner
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSerde:
      type: object
      properties:
        mode:
          title: Operation mode
          type: string
          description: Extract creates new fields. Reserialize extracts and filters
            fields, and then reserializes.
          enum:
            - extract
            - reserialize
          x-speakeasy-enum-descriptions:
            - Extract
            - Reserialize
          x-speakeasy-unknown-values: allow
        type:
          $ref: "#/components/schemas/TypeOptions"
        srcField:
          title: Source field
          description: Field containing text to be parsed
          type: string
        dstField:
          title: Destination field
          description: Name of the field to add fields to. Extract mode only.
          type: string
        keep:
          title: Fields to keep
          description: List of fields to keep. Supports wildcards (*). Takes precedence
            over 'Fields to remove'.
          type: array
          items:
            type: string
        remove:
          title: Fields to remove
          description: List of fields to remove. Supports wildcards (*). Cannot remove
            fields that match 'Fields to keep'.
          type: array
          items:
            type: string
        fieldFilterExpr:
          title: Fields filter expression
          description: Expression evaluated against {index, name, value} context. Return
            truthy to keep a field, or falsy to remove it.
          type: string
        allowedKeyChars:
          type: array
          items:
            type: string
          title: Allowed key characters
          description: A list of characters that may be present in a key name, even though
            they are normally separator or control characters
        allowedValueChars:
          type: array
          items:
            type: string
          title: Allowed value characters
          description: A list of characters that may be present in a value, even though
            they are normally separator or control characters
        fields:
          title: List of fields
          description: The fields to be extracted, listed in order. Will auto-generate if
            empty.
          type: array
          items:
            type: string
        regex:
          type: string
          title: Regex
          description: Regex literal with named capturing groups, such as (?<foo>bar), or
            _NAME_ and _VALUE_ capturing groups, such as(?<_NAME_0>[^
            =]+)=(?<_VALUE_0>[^,]+)
        regexList:
          type: array
          title: Additional regex
          items:
            $ref: "#/components/schemas/RegexListConfSerdeTypeRegex"
        iterations:
          type: number
          title: Max exec
          description: The maximum number of times to apply regex to source field when the
            global flag is set, or when using _NAME_ and _VALUE_ capturing
            groups
          minimum: 1
        fieldNameExpression:
          title: Field name format expression
          description: "JavaScript expression to format field names when _NAME_n and
            _VALUE_n capturing groups are used. Original field name is in global
            variable 'name'. Example: To append XX to all field names, use
            `${name}_XX` (backticks are literal). If empty, names will be
            sanitized using this regex: /^[_0-9]+|[^a-zA-Z0-9_]+/g. You can
            access other fields values via __e.<fieldName>."
          type: string
        overwrite:
          type: boolean
          title: Overwrite existing fields
          description: Overwrite existing event fields with extracted values. If disabled,
            existing fields will be converted to an array.
        pattern:
          type: string
          title: Pattern
          description: "Grok pattern to extract fields. Syntax supported:
            %{PATTERN_NAME:FIELD_NAME}"
        patternList:
          type: array
          title: Additional Grok patterns
          items:
            $ref: "#/components/schemas/PatternListConfSerdeTypeGrok"
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/SerdeTypeKvp"
            - $ref: "#/components/schemas/SerdeTypeDelim"
            - $ref: "#/components/schemas/SerdeTypeCsv"
            - $ref: "#/components/schemas/SerdeTypeJson"
            - $ref: "#/components/schemas/SerdeTypeRegex"
            - $ref: "#/components/schemas/SerdeTypeGrok"
          discriminator:
            propertyName: type
            mapping:
              kvp: "#/components/schemas/SerdeTypeKvp"
              delim: "#/components/schemas/SerdeTypeDelim"
              csv: "#/components/schemas/SerdeTypeCsv"
              json: "#/components/schemas/SerdeTypeJson"
              regex: "#/components/schemas/SerdeTypeRegex"
              grok: "#/components/schemas/SerdeTypeGrok"
    FunctionSerde:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - serde
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSerialize:
      type: object
      properties:
        type:
          title: Type
          description: Data output format
          type: string
          enum:
            - csv
            - elff
            - clf
            - kvp
            - json
            - delim
          x-speakeasy-enum-descriptions:
            - CSV
            - Extended Log File Format
            - Common Log Format
            - Key=Value Pairs
            - JSON Object
            - Delimited values
          x-speakeasy-unknown-values: allow
        fields:
          title: Fields to serialize
          description: "Required for CSV, ELFF, CLF, and Delimited values. All other
            formats support wildcard field lists. Examples: host, array*, !host
            *"
          type: array
          items:
            type: string
        srcField:
          title: Source field
          description: Field containing object to serialize. Leave blank to serialize
            top-level event fields.
          type: string
        dstField:
          title: Destination field
          description: Field to serialize data to
          type: string
        cleanFields:
          type: boolean
          title: Clean fields
          description: Clean field names by replacing non-[a-zA-Z0-9] characters with _
        pairDelimiter:
          type: string
          title: Pair delimiter
          minLength: 1
          description: Delimiter used to separate key=value pairs. Defaults to a single
            space character. Should not have common characters with key-value
            delimiter.
        keyValueDelimiter:
          type: string
          title: Key-Value delimiter
          minLength: 1
          description: Delimiter used to separate key and value in pair. Defaults to a
            '='. Should not have common characters with pair delimiter.
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/SerializeTypeKvp"
            - $ref: "#/components/schemas/SerializeTypeDelim"
            - $ref: "#/components/schemas/SerializeTypeCsv"
          discriminator:
            propertyName: type
            mapping:
              kvp: "#/components/schemas/SerializeTypeKvp"
              delim: "#/components/schemas/SerializeTypeDelim"
              csv: "#/components/schemas/SerializeTypeCsv"
    FunctionSerialize:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - serialize
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSidlookup:
      type: object
      properties:
        fields:
          title: Lookup fields
          description: Set of expressions matched to lookup responses
          type: array
          items:
            type: object
            required:
              - expr
            properties:
              name:
                type: string
                title: Name
              expr:
                type: string
                title: Value Expression
                description: JavaScript expression to compute the value (can be constant)
              disabled:
                type: boolean
                description: Set to No to disable the evaluation of an individual expression
    FunctionSidlookup:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - sidlookup
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSignalFilter:
      type: object
      title: Signal Filter Configuration
      additionalProperties: false
      properties:
        signals:
          type: array
          title: Signal event types to filter
          description: List of signal event types to filter
          items:
            type: string
    FunctionSignalFilter:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - signal_filter
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSnmpTrapSerialize:
      type: object
      properties:
        strict:
          type: boolean
          title: Enforce required fields
          description: Prevent event serialization if any required fields are missing.
            When disabled, @{product} will attempt to serialize the event even
            if required fields are missing, which could cause unexpected
            behavior at the downstream receiver.
        dropFailedEvents:
          type: boolean
          title: Drop failed events
          description: When disabled, `snmpSerializeErrors` will be set on the event, and
            the `__snmpRaw` field will be removed to prevent @{product} from
            sending the event from the SNMP Trap Destination
        v3User:
          type: object
          properties:
            name:
              title: Username
              type: string
              minLength: 1
            authProtocol:
              $ref: "#/components/schemas/AuthenticationProtocolOptionsV3User"
            privProtocol:
              type: string
          allOf:
            - oneOf:
                - $ref: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNone"
                - $ref: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNone"
              discriminator:
                propertyName: authProtocol
                mapping:
                  none: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNone"
                  md5: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNone"
                  sha: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNone"
                  sha224: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNone"
                  sha256: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNone"
                  sha384: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNone"
                  sha512: "#/components/schemas/SnmpTrapSerializeV3UserAuthProtocolNotNone"
    FunctionSnmpTrapSerialize:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - snmp_trap_serialize
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSort:
      type: object
      title: Sort Configuration
      additionalProperties: false
      properties:
        sortId:
          title: Identifier for the specific sort operation
          description: Has to be unique if there are multiple sorts on the pipeline.
          type: string
        comparisonExpression:
          title: Expression to compare two events
          description: The expression can access the events via the 'left' and 'right'
            properties.
          type: string
        topN:
          title: The amount of events to return sorted
          description: Limits the output to N (highest/lowest) events
          type: number
        maxEvents:
          title: The maximum number of events in input
          description: Specifies the number of events that can flow into this function
          type: number
        suppressPreviews:
          type: boolean
          title: Disable intermediate results
          description: Toggle this on to suppress generating previews of intermediate
            results
    FunctionSort:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - sort
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaStore:
      type: object
      title: Store Function Configuration
      additionalProperties: false
      properties:
        type:
          title: Output type
          description: The type of knowledge object, generated by the function (i.e.,
            'lookup')
          type: string
        destination:
          title: Configuration for store destination
          description: Configures where and how the data should be stored
          type: string
        description:
          title: Description for object
          description: The knowledge object's description
          type: string
        fieldMapping:
          title: Mapping of field names
          description: Mapping event property names to output field names
          type: object
        separator:
          title: Separator for CSV output
          description: Character to be used as value delimiter in output
          type: string
        overwrite:
          title: Overwrite destination
          description: For existing files, an error is thrown if overwrite is false or the
            file is replaced if overwrite is true
          type: boolean
        compress:
          title: Compress the output
          description: True will compress output, false leaves it as it is and auto
            decides based on size
          type: string
        tee:
          title: Tee Results
          description: Tee results to the next operator
          type: boolean
        maxEvents:
          title: Maximum number of events
          description: Limits how many events can be stored
          type: number
        suppressPreviews:
          title: Suppress previews
          description: Suppresses the timer-based export stats generating
          type: boolean
    FunctionStore:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - store
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaSuppress:
      type: object
      properties:
        keyExpr:
          type: string
          title: Key expression
          description: Suppression key expression used to uniquely identify events to
            suppress. For example, `${ip}:${port}` will use fields ip and port
            from each event to generate the key.
        allow:
          type: number
          title: Number to allow
          minimum: 1
          description: The number of events to allow per time period
        suppressPeriodSec:
          type: number
          title: Suppression period (sec)
          minimum: 0
          description: The number of seconds to suppress events after 'Number to allow'
            events are received
        dropEventsMode:
          type: boolean
          title: Drop suppressed events
          description: If disabled, suppressed events will be tagged with suppress=1 but
            not dropped
        maxCacheSize:
          type: number
          title: Cache size limit
          description: The maximum number of keys that can be cached before idle entries
            are removed. Leave at default unless you understand the implications
            of changing.
        cacheIdleTimeoutPeriods:
          type: number
          title: Suppression period timeout
          description: The number of suppression periods 'Suppression Period' of
            inactivity before a cache entry is considered idle. Leave at default
            unless you understand the implications of changing.
        numEventsIdleTimeoutTrigger:
          type: number
          title: Num events to trigger cache clean-up
          description: Check cache for idle sessions every N events when cache size is >
            'Maximum Cache Size'. Leave at default unless you understand the
            implications of changing.
    FunctionSuppress:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - suppress
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaTee:
      type: object
      properties:
        command:
          type: string
          title: Command
          description: Command to execute and feed events to, via stdin. One
            JSON-formatted event per line.
        args:
          type: array
          title: Command arguments
          items:
            type: string
        restartOnExit:
          type: boolean
          title: Restart on exit
          description: Restart the process if it exits and/or we fail to write to it
        env:
          type: object
          title: Environment variables
          description: Environment variables to overwrite or set
          additionalProperties:
            type: string
    FunctionTee:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - tee
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaTrimTimestamp:
      type: object
      properties:
        field:
          type: string
          title: Field name
          description: Name of field in which to save the timestamp. (If empty, timestamp
            will not be saved to a field.)
    FunctionTrimTimestamp:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - trim_timestamp
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaUnion:
      type: object
      title: Union Configuration
      additionalProperties: false
      properties:
        searchJobId:
          title: Search Job Id
          description: The id for this search job.
          type: string
        stageIds:
          title: Stage Ids
          description: The stages we are unioning with.
          type: array
          minItems: 1
          items:
            type: string
    FunctionUnion:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - union
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaUnroll:
      type: object
      properties:
        srcExpr:
          type: string
          title: Source field expression
          description: "Field in which to find/calculate the array to unroll. Example:
            _raw, _raw.split(/\\n/)"
        dstField:
          type: string
          title: Destination field
          description: Field in destination event in which to place the unrolled value
    FunctionUnroll:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - unroll
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaWindow:
      type: object
      additionalProperties: false
      properties:
        eventWindowId:
          title: Unique Identifier
          description: Identifies the unique ID, used for a event window
          type: number
        registeredFunctions:
          title: Registered Window Functions
          description: All window functions, tracked by this event window
          type: array
          minItems: 1
          items:
            type: string
        tailEventCount:
          title: Tail Event Count
          description: Number of events to keep before the current event in the window
          type: number
        headEventCount:
          title: Head Event Count
          description: Number of events to keep after the current event in the window
          type: number
    FunctionWindow:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - window
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionConfSchemaXmlUnroll:
      type: object
      properties:
        unroll:
          type: string
          title: Unroll elements regex
          description: "Path to array to unroll. Example: ^root\\.child\\.ElementToUnroll$"
        inherit:
          type: string
          title: Copy elements regex
          description: "Regex matching elements to copy into each unrolled event. Example:
            ^root\\.(childA|childB|childC)$"
        unrollIdxField:
          type: string
          title: Unroll index field
          description: Add a field with this name, containing the index at which the item
            was located, starting from 0
        pretty:
          type: boolean
          title: Pretty print
          description: Pretty print the output XML
    FunctionXmlUnroll:
      type: object
      properties:
        __filename:
          type: string
        asyncTimeout:
          type: number
        cribl_version:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        handleSignals:
          type: boolean
        id:
          type: string
          enum:
            - xml_unroll
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        sync:
          type: boolean
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
        schema:
          type: object
          additionalProperties: true
      required:
        - __filename
        - group
        - id
        - loadTime
        - modTime
        - name
        - uischema
        - version
    FunctionResponse:
      oneOf:
        - $ref: "#/components/schemas/FunctionAggregateMetrics"
        - $ref: "#/components/schemas/FunctionAggregation"
        - $ref: "#/components/schemas/FunctionAutoTimestamp"
        - $ref: "#/components/schemas/FunctionCef"
        - $ref: "#/components/schemas/FunctionChain"
        - $ref: "#/components/schemas/FunctionClone"
        - $ref: "#/components/schemas/FunctionCode"
        - $ref: "#/components/schemas/FunctionComment"
        - $ref: "#/components/schemas/FunctionDistinct"
        - $ref: "#/components/schemas/FunctionDnsLookup"
        - $ref: "#/components/schemas/FunctionDrop"
        - $ref: "#/components/schemas/FunctionDropDimensions"
        - $ref: "#/components/schemas/FunctionDynamicSampling"
        - $ref: "#/components/schemas/FunctionEval"
        - $ref: "#/components/schemas/FunctionEventBreaker"
        - $ref: "#/components/schemas/FunctionEventstats"
        - $ref: "#/components/schemas/FunctionExternaldata"
        - $ref: "#/components/schemas/FunctionFlatten"
        - $ref: "#/components/schemas/FunctionFoldkeys"
        - $ref: "#/components/schemas/FunctionGenStats"
        - $ref: "#/components/schemas/FunctionGeoip"
        - $ref: "#/components/schemas/FunctionGrok"
        - $ref: "#/components/schemas/FunctionHandlebars"
        - $ref: "#/components/schemas/FunctionJoin"
        - $ref: "#/components/schemas/FunctionJsonUnroll"
        - $ref: "#/components/schemas/FunctionLakeExport"
        - $ref: "#/components/schemas/FunctionLimit"
        - $ref: "#/components/schemas/FunctionLocalSearchDatatypeParser"
        - $ref: "#/components/schemas/FunctionLocalSearchRulesetRunner"
        - $ref: "#/components/schemas/FunctionLocalSearchSchemaMapper"
        - $ref: "#/components/schemas/FunctionLocalSearchTimeRangeNormalizer"
        - $ref: "#/components/schemas/FunctionLocalSearchTransformer"
        - $ref: "#/components/schemas/FunctionLookup"
        - $ref: "#/components/schemas/FunctionMask"
        - $ref: "#/components/schemas/FunctionMvExpand"
        - $ref: "#/components/schemas/FunctionMvPull"
        - $ref: "#/components/schemas/FunctionNotificationPolicies"
        - $ref: "#/components/schemas/FunctionNotifications"
        - $ref: "#/components/schemas/FunctionNotify"
        - $ref: "#/components/schemas/FunctionNumerify"
        - $ref: "#/components/schemas/FunctionOtlpLogs"
        - $ref: "#/components/schemas/FunctionOtlpMetrics"
        - $ref: "#/components/schemas/FunctionOtlpTraces"
        - $ref: "#/components/schemas/FunctionPack"
        - $ref: "#/components/schemas/FunctionPivot"
        - $ref: "#/components/schemas/FunctionPublishMetrics"
        - $ref: "#/components/schemas/FunctionRedis"
        - $ref: "#/components/schemas/FunctionRegexExtract"
        - $ref: "#/components/schemas/FunctionRegexFilter"
        - $ref: "#/components/schemas/FunctionRename"
        - $ref: "#/components/schemas/FunctionRollupMetrics"
        - $ref: "#/components/schemas/FunctionSampling"
        - $ref: "#/components/schemas/FunctionSearchEngineExport"
        - $ref: "#/components/schemas/FunctionSend"
        - $ref: "#/components/schemas/FunctionSensitiveDataScanner"
        - $ref: "#/components/schemas/FunctionSerde"
        - $ref: "#/components/schemas/FunctionSerialize"
        - $ref: "#/components/schemas/FunctionSidlookup"
        - $ref: "#/components/schemas/FunctionSignalFilter"
        - $ref: "#/components/schemas/FunctionSnmpTrapSerialize"
        - $ref: "#/components/schemas/FunctionSort"
        - $ref: "#/components/schemas/FunctionStore"
        - $ref: "#/components/schemas/FunctionSuppress"
        - $ref: "#/components/schemas/FunctionTee"
        - $ref: "#/components/schemas/FunctionTrimTimestamp"
        - $ref: "#/components/schemas/FunctionUnion"
        - $ref: "#/components/schemas/FunctionUnroll"
        - $ref: "#/components/schemas/FunctionWindow"
        - $ref: "#/components/schemas/FunctionXmlUnroll"
      discriminator:
        propertyName: id
        mapping:
          aggregate_metrics: "#/components/schemas/FunctionAggregateMetrics"
          aggregation: "#/components/schemas/FunctionAggregation"
          auto_timestamp: "#/components/schemas/FunctionAutoTimestamp"
          cef: "#/components/schemas/FunctionCef"
          chain: "#/components/schemas/FunctionChain"
          clone: "#/components/schemas/FunctionClone"
          code: "#/components/schemas/FunctionCode"
          comment: "#/components/schemas/FunctionComment"
          distinct: "#/components/schemas/FunctionDistinct"
          dns_lookup: "#/components/schemas/FunctionDnsLookup"
          drop: "#/components/schemas/FunctionDrop"
          drop_dimensions: "#/components/schemas/FunctionDropDimensions"
          dynamic_sampling: "#/components/schemas/FunctionDynamicSampling"
          eval: "#/components/schemas/FunctionEval"
          event_breaker: "#/components/schemas/FunctionEventBreaker"
          eventstats: "#/components/schemas/FunctionEventstats"
          externaldata: "#/components/schemas/FunctionExternaldata"
          flatten: "#/components/schemas/FunctionFlatten"
          foldkeys: "#/components/schemas/FunctionFoldkeys"
          gen_stats: "#/components/schemas/FunctionGenStats"
          geoip: "#/components/schemas/FunctionGeoip"
          grok: "#/components/schemas/FunctionGrok"
          handlebars: "#/components/schemas/FunctionHandlebars"
          join: "#/components/schemas/FunctionJoin"
          json_unroll: "#/components/schemas/FunctionJsonUnroll"
          lake_export: "#/components/schemas/FunctionLakeExport"
          limit: "#/components/schemas/FunctionLimit"
          local_search_datatype_parser: "#/components/schemas/FunctionLocalSearchDatatypeParser"
          local_search_ruleset_runner: "#/components/schemas/FunctionLocalSearchRulesetRunner"
          local_search_schema_mapper: "#/components/schemas/FunctionLocalSearchSchemaMapper"
          local_search_time_range_normalizer: "#/components/schemas/FunctionLocalSearchTimeRangeNormalizer"
          local_search_transformer: "#/components/schemas/FunctionLocalSearchTransformer"
          lookup: "#/components/schemas/FunctionLookup"
          mask: "#/components/schemas/FunctionMask"
          mv_expand: "#/components/schemas/FunctionMvExpand"
          mv_pull: "#/components/schemas/FunctionMvPull"
          notification_policies: "#/components/schemas/FunctionNotificationPolicies"
          notifications: "#/components/schemas/FunctionNotifications"
          notify: "#/components/schemas/FunctionNotify"
          numerify: "#/components/schemas/FunctionNumerify"
          otlp_logs: "#/components/schemas/FunctionOtlpLogs"
          otlp_metrics: "#/components/schemas/FunctionOtlpMetrics"
          otlp_traces: "#/components/schemas/FunctionOtlpTraces"
          pack: "#/components/schemas/FunctionPack"
          pivot: "#/components/schemas/FunctionPivot"
          publish_metrics: "#/components/schemas/FunctionPublishMetrics"
          redis: "#/components/schemas/FunctionRedis"
          regex_extract: "#/components/schemas/FunctionRegexExtract"
          regex_filter: "#/components/schemas/FunctionRegexFilter"
          rename: "#/components/schemas/FunctionRename"
          rollup_metrics: "#/components/schemas/FunctionRollupMetrics"
          sampling: "#/components/schemas/FunctionSampling"
          search_engine_export: "#/components/schemas/FunctionSearchEngineExport"
          send: "#/components/schemas/FunctionSend"
          sensitive_data_scanner: "#/components/schemas/FunctionSensitiveDataScanner"
          serde: "#/components/schemas/FunctionSerde"
          serialize: "#/components/schemas/FunctionSerialize"
          sidlookup: "#/components/schemas/FunctionSidlookup"
          signal_filter: "#/components/schemas/FunctionSignalFilter"
          snmp_trap_serialize: "#/components/schemas/FunctionSnmpTrapSerialize"
          sort: "#/components/schemas/FunctionSort"
          store: "#/components/schemas/FunctionStore"
          suppress: "#/components/schemas/FunctionSuppress"
          tee: "#/components/schemas/FunctionTee"
          trim_timestamp: "#/components/schemas/FunctionTrimTimestamp"
          union: "#/components/schemas/FunctionUnion"
          unroll: "#/components/schemas/FunctionUnroll"
          window: "#/components/schemas/FunctionWindow"
          xml_unroll: "#/components/schemas/FunctionXmlUnroll"
    PipelineFunctionAggregateMetrics:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - aggregate_metrics
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaAggregateMetrics"
          required:
            - timeWindow
            - aggregations
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionAggregation:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - aggregation
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaAggregation"
          required:
            - timeWindow
            - aggregations
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionAutoTimestamp:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - auto_timestamp
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaAutoTimestamp"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionCef:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - cef
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaCef"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionChain:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - chain
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaChain"
          required:
            - processor
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionClone:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - clone
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaClone"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionCode:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - code
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaCode"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionComment:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - comment
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaComment"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionDistinct:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - distinct
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaDistinct"
          required:
            - groupBy
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionDnsLookup:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - dns_lookup
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaDnsLookup"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionDrop:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - drop
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaDrop"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionDropDimensions:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - drop_dimensions
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaDropDimensions"
          required:
            - timeWindow
            - dropDimensions
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionDynamicSampling:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - dynamic_sampling
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaDynamicSampling"
          required:
            - mode
            - keyExpr
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionEval:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - eval
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaEval"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionEventBreaker:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - event_breaker
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaEventBreaker"
          required:
            - existingOrNew
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionEventstats:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - eventstats
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaEventstats"
          required:
            - aggregations
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionExternaldata:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - externaldata
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaExternaldata"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionFlatten:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - flatten
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaFlatten"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionFoldkeys:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - foldkeys
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaFoldkeys"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionGenStats:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - gen_stats
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaGenStats"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionGeoip:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - geoip
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaGeoip"
          required:
            - file
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionGrok:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - grok
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaGrok"
          required:
            - pattern
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionHandlebars:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - handlebars
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaHandlebars"
          required:
            - templates
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionJoin:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - join
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaJoin"
          required:
            - fieldConditions
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionJsonUnroll:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - json_unroll
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaJsonUnroll"
          required:
            - path
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionLakeExport:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - lake_export
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaLakeExport"
          required:
            - dataset
            - searchJobId
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionLimit:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - limit
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaLimit"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionLocalSearchDatatypeParser:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - local_search_datatype_parser
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaLocalSearchDatatypeParser"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionLocalSearchRulesetRunner:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - local_search_ruleset_runner
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaLocalSearchRulesetRunner"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionLocalSearchSchemaMapper:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - local_search_schema_mapper
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaLocalSearchSchemaMapper"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionLocalSearchTimeRangeNormalizer:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - local_search_time_range_normalizer
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaLocalSearchTimeRangeNormalizer"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionLocalSearchTransformer:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - local_search_transformer
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaLocalSearchTransformer"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionLookup:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - lookup
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaLookup"
          required:
            - file
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionMask:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - mask
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaMask"
          required:
            - rules
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionMvExpand:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - mv_expand
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaMvExpand"
          required:
            - sourceFields
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionMvPull:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - mv_pull
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaMvPull"
          required:
            - arrayPath
            - relativeKeyPath
            - relativeValuePath
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionNotificationPolicies:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - notification_policies
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaNotificationPolicies"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionNotifications:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - notifications
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaNotifications"
          required:
            - id
            - field
            - deduplicate
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionNotify:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - notify
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaNotify"
          required:
            - searchId
            - notificationId
            - savedQueryId
            - group
            - searchUrl
            - messagesEndpoint
            - authToken
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionNumerify:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - numerify
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaNumerify"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionOtlpLogs:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - otlp_logs
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaOtlpLogs"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionOtlpMetrics:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - otlp_metrics
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaOtlpMetrics"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionOtlpTraces:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - otlp_traces
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaOtlpTraces"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionPack:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - pack
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaPack"
          required:
            - unpackedFields
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionPivot:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - pivot
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaPivot"
          required:
            - labelField
            - dataFields
            - qualifierFields
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionPublishMetrics:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - publish_metrics
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaPublishMetrics"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionRedis:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - redis
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaRedis"
          required:
            - commands
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionRegexExtract:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - regex_extract
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaRegexExtract"
          required:
            - regex
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionRegexFilter:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - regex_filter
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaRegexFilter"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionRename:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - rename
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaRename"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionRollupMetrics:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - rollup_metrics
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaRollupMetrics"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSampling:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - sampling
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaSampling"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSearchEngineExport:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - search_engine_export
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaSearchEngineExport"
          required:
            - dataset
            - searchJobId
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSend:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - send
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaSend"
          required:
            - searchId
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSensitiveDataScanner:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - sensitive_data_scanner
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaSensitiveDataScanner"
          required:
            - rules
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSerde:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - serde
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaSerde"
          required:
            - mode
            - type
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSerialize:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - serialize
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaSerialize"
          required:
            - type
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSidlookup:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - sidlookup
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaSidlookup"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSignalFilter:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - signal_filter
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaSignalFilter"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSnmpTrapSerialize:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - snmp_trap_serialize
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaSnmpTrapSerialize"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSort:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - sort
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaSort"
          required:
            - comparisonExpression
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionStore:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - store
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaStore"
          required:
            - type
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionSuppress:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - suppress
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaSuppress"
          required:
            - keyExpr
            - allow
            - suppressPeriodSec
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionTee:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - tee
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaTee"
          required:
            - command
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionTrimTimestamp:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - trim_timestamp
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          $ref: "#/components/schemas/FunctionConfSchemaTrimTimestamp"
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionUnion:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - union
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaUnion"
          required:
            - searchJobId
            - stageIds
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionUnroll:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - unroll
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaUnroll"
          required:
            - srcExpr
            - dstField
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionWindow:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - window
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaWindow"
          required:
            - eventWindowId
            - registeredFunctions
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionXmlUnroll:
      type: object
      required:
        - id
        - conf
      additionalProperties: false
      properties:
        filter:
          title: Filter
          description: Filter that selects data to be fed through this Function
          type: string
        id:
          title: ID
          description: Function ID
          type: string
          enum:
            - xml_unroll
        description:
          title: Description
          description: Simple description of this step
          type: string
        disabled:
          title: Disabled
          description: If true, data will not be pushed through this function
          type: boolean
        final:
          title: Final
          description: If enabled, stops the results of this Function from being passed to
            the downstream Functions
          type: boolean
        conf:
          allOf:
            - $ref: "#/components/schemas/FunctionConfSchemaXmlUnroll"
          required:
            - unroll
        groupId:
          title: Group ID
          description: Group ID
          type: string
    PipelineFunctionConf:
      oneOf:
        - $ref: "#/components/schemas/PipelineFunctionAggregateMetrics"
        - $ref: "#/components/schemas/PipelineFunctionAggregation"
        - $ref: "#/components/schemas/PipelineFunctionAutoTimestamp"
        - $ref: "#/components/schemas/PipelineFunctionCef"
        - $ref: "#/components/schemas/PipelineFunctionChain"
        - $ref: "#/components/schemas/PipelineFunctionClone"
        - $ref: "#/components/schemas/PipelineFunctionCode"
        - $ref: "#/components/schemas/PipelineFunctionComment"
        - $ref: "#/components/schemas/PipelineFunctionDistinct"
        - $ref: "#/components/schemas/PipelineFunctionDnsLookup"
        - $ref: "#/components/schemas/PipelineFunctionDrop"
        - $ref: "#/components/schemas/PipelineFunctionDropDimensions"
        - $ref: "#/components/schemas/PipelineFunctionDynamicSampling"
        - $ref: "#/components/schemas/PipelineFunctionEval"
        - $ref: "#/components/schemas/PipelineFunctionEventBreaker"
        - $ref: "#/components/schemas/PipelineFunctionEventstats"
        - $ref: "#/components/schemas/PipelineFunctionExternaldata"
        - $ref: "#/components/schemas/PipelineFunctionFlatten"
        - $ref: "#/components/schemas/PipelineFunctionFoldkeys"
        - $ref: "#/components/schemas/PipelineFunctionGenStats"
        - $ref: "#/components/schemas/PipelineFunctionGeoip"
        - $ref: "#/components/schemas/PipelineFunctionGrok"
        - $ref: "#/components/schemas/PipelineFunctionHandlebars"
        - $ref: "#/components/schemas/PipelineFunctionJoin"
        - $ref: "#/components/schemas/PipelineFunctionJsonUnroll"
        - $ref: "#/components/schemas/PipelineFunctionLakeExport"
        - $ref: "#/components/schemas/PipelineFunctionLimit"
        - $ref: "#/components/schemas/PipelineFunctionLocalSearchDatatypeParser"
        - $ref: "#/components/schemas/PipelineFunctionLocalSearchRulesetRunner"
        - $ref: "#/components/schemas/PipelineFunctionLocalSearchSchemaMapper"
        - $ref: "#/components/schemas/PipelineFunctionLocalSearchTimeRangeNormalizer"
        - $ref: "#/components/schemas/PipelineFunctionLocalSearchTransformer"
        - $ref: "#/components/schemas/PipelineFunctionLookup"
        - $ref: "#/components/schemas/PipelineFunctionMask"
        - $ref: "#/components/schemas/PipelineFunctionMvExpand"
        - $ref: "#/components/schemas/PipelineFunctionMvPull"
        - $ref: "#/components/schemas/PipelineFunctionNotificationPolicies"
        - $ref: "#/components/schemas/PipelineFunctionNotifications"
        - $ref: "#/components/schemas/PipelineFunctionNotify"
        - $ref: "#/components/schemas/PipelineFunctionNumerify"
        - $ref: "#/components/schemas/PipelineFunctionOtlpLogs"
        - $ref: "#/components/schemas/PipelineFunctionOtlpMetrics"
        - $ref: "#/components/schemas/PipelineFunctionOtlpTraces"
        - $ref: "#/components/schemas/PipelineFunctionPack"
        - $ref: "#/components/schemas/PipelineFunctionPivot"
        - $ref: "#/components/schemas/PipelineFunctionPublishMetrics"
        - $ref: "#/components/schemas/PipelineFunctionRedis"
        - $ref: "#/components/schemas/PipelineFunctionRegexExtract"
        - $ref: "#/components/schemas/PipelineFunctionRegexFilter"
        - $ref: "#/components/schemas/PipelineFunctionRename"
        - $ref: "#/components/schemas/PipelineFunctionRollupMetrics"
        - $ref: "#/components/schemas/PipelineFunctionSampling"
        - $ref: "#/components/schemas/PipelineFunctionSearchEngineExport"
        - $ref: "#/components/schemas/PipelineFunctionSend"
        - $ref: "#/components/schemas/PipelineFunctionSensitiveDataScanner"
        - $ref: "#/components/schemas/PipelineFunctionSerde"
        - $ref: "#/components/schemas/PipelineFunctionSerialize"
        - $ref: "#/components/schemas/PipelineFunctionSidlookup"
        - $ref: "#/components/schemas/PipelineFunctionSignalFilter"
        - $ref: "#/components/schemas/PipelineFunctionSnmpTrapSerialize"
        - $ref: "#/components/schemas/PipelineFunctionSort"
        - $ref: "#/components/schemas/PipelineFunctionStore"
        - $ref: "#/components/schemas/PipelineFunctionSuppress"
        - $ref: "#/components/schemas/PipelineFunctionTee"
        - $ref: "#/components/schemas/PipelineFunctionTrimTimestamp"
        - $ref: "#/components/schemas/PipelineFunctionUnion"
        - $ref: "#/components/schemas/PipelineFunctionUnroll"
        - $ref: "#/components/schemas/PipelineFunctionWindow"
        - $ref: "#/components/schemas/PipelineFunctionXmlUnroll"
      discriminator:
        propertyName: id
        mapping:
          aggregate_metrics: "#/components/schemas/PipelineFunctionAggregateMetrics"
          aggregation: "#/components/schemas/PipelineFunctionAggregation"
          auto_timestamp: "#/components/schemas/PipelineFunctionAutoTimestamp"
          cef: "#/components/schemas/PipelineFunctionCef"
          chain: "#/components/schemas/PipelineFunctionChain"
          clone: "#/components/schemas/PipelineFunctionClone"
          code: "#/components/schemas/PipelineFunctionCode"
          comment: "#/components/schemas/PipelineFunctionComment"
          distinct: "#/components/schemas/PipelineFunctionDistinct"
          dns_lookup: "#/components/schemas/PipelineFunctionDnsLookup"
          drop: "#/components/schemas/PipelineFunctionDrop"
          drop_dimensions: "#/components/schemas/PipelineFunctionDropDimensions"
          dynamic_sampling: "#/components/schemas/PipelineFunctionDynamicSampling"
          eval: "#/components/schemas/PipelineFunctionEval"
          event_breaker: "#/components/schemas/PipelineFunctionEventBreaker"
          eventstats: "#/components/schemas/PipelineFunctionEventstats"
          externaldata: "#/components/schemas/PipelineFunctionExternaldata"
          flatten: "#/components/schemas/PipelineFunctionFlatten"
          foldkeys: "#/components/schemas/PipelineFunctionFoldkeys"
          gen_stats: "#/components/schemas/PipelineFunctionGenStats"
          geoip: "#/components/schemas/PipelineFunctionGeoip"
          grok: "#/components/schemas/PipelineFunctionGrok"
          handlebars: "#/components/schemas/PipelineFunctionHandlebars"
          join: "#/components/schemas/PipelineFunctionJoin"
          json_unroll: "#/components/schemas/PipelineFunctionJsonUnroll"
          lake_export: "#/components/schemas/PipelineFunctionLakeExport"
          limit: "#/components/schemas/PipelineFunctionLimit"
          local_search_datatype_parser: "#/components/schemas/PipelineFunctionLocalSearchDatatypeParser"
          local_search_ruleset_runner: "#/components/schemas/PipelineFunctionLocalSearchRulesetRunner"
          local_search_schema_mapper: "#/components/schemas/PipelineFunctionLocalSearchSchemaMapper"
          local_search_time_range_normalizer: "#/components/schemas/PipelineFunctionLocalSearchTimeRangeNormalizer"
          local_search_transformer: "#/components/schemas/PipelineFunctionLocalSearchTransformer"
          lookup: "#/components/schemas/PipelineFunctionLookup"
          mask: "#/components/schemas/PipelineFunctionMask"
          mv_expand: "#/components/schemas/PipelineFunctionMvExpand"
          mv_pull: "#/components/schemas/PipelineFunctionMvPull"
          notification_policies: "#/components/schemas/PipelineFunctionNotificationPolicies"
          notifications: "#/components/schemas/PipelineFunctionNotifications"
          notify: "#/components/schemas/PipelineFunctionNotify"
          numerify: "#/components/schemas/PipelineFunctionNumerify"
          otlp_logs: "#/components/schemas/PipelineFunctionOtlpLogs"
          otlp_metrics: "#/components/schemas/PipelineFunctionOtlpMetrics"
          otlp_traces: "#/components/schemas/PipelineFunctionOtlpTraces"
          pack: "#/components/schemas/PipelineFunctionPack"
          pivot: "#/components/schemas/PipelineFunctionPivot"
          publish_metrics: "#/components/schemas/PipelineFunctionPublishMetrics"
          redis: "#/components/schemas/PipelineFunctionRedis"
          regex_extract: "#/components/schemas/PipelineFunctionRegexExtract"
          regex_filter: "#/components/schemas/PipelineFunctionRegexFilter"
          rename: "#/components/schemas/PipelineFunctionRename"
          rollup_metrics: "#/components/schemas/PipelineFunctionRollupMetrics"
          sampling: "#/components/schemas/PipelineFunctionSampling"
          search_engine_export: "#/components/schemas/PipelineFunctionSearchEngineExport"
          send: "#/components/schemas/PipelineFunctionSend"
          sensitive_data_scanner: "#/components/schemas/PipelineFunctionSensitiveDataScanner"
          serde: "#/components/schemas/PipelineFunctionSerde"
          serialize: "#/components/schemas/PipelineFunctionSerialize"
          sidlookup: "#/components/schemas/PipelineFunctionSidlookup"
          signal_filter: "#/components/schemas/PipelineFunctionSignalFilter"
          snmp_trap_serialize: "#/components/schemas/PipelineFunctionSnmpTrapSerialize"
          sort: "#/components/schemas/PipelineFunctionSort"
          store: "#/components/schemas/PipelineFunctionStore"
          suppress: "#/components/schemas/PipelineFunctionSuppress"
          tee: "#/components/schemas/PipelineFunctionTee"
          trim_timestamp: "#/components/schemas/PipelineFunctionTrimTimestamp"
          union: "#/components/schemas/PipelineFunctionUnion"
          unroll: "#/components/schemas/PipelineFunctionUnroll"
          window: "#/components/schemas/PipelineFunctionWindow"
          xml_unroll: "#/components/schemas/PipelineFunctionXmlUnroll"
    CollectorBase:
      type: object
      required:
        - type
        - conf
      properties:
        type:
          type: string
          description: Collector type
        conf:
          type: object
          description: Collector configuration
        destructive:
          type: boolean
          description: Delete any files collected (where applicable)
        encoding:
          type: string
          description: Character encoding to use when parsing ingested data.
      description: Base collector schema
    AzureBlobAuthTypeManual:
      type: object
      properties:
        authType:
          enum:
            - manual
          type: string
        connectionString:
          type: string
          title: Connection string
          description: Enter your Azure storage account Connection String. If left blank,
            Cribl Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING.
        __template_connectionString:
          type: string
          description: Binds 'connectionString' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'connectionString' at runtime.
      required:
        - connectionString
    AzureBlobAuthTypeSecret:
      type: object
      properties:
        authType:
          enum:
            - secret
          type: string
        textSecret:
          type: string
          title: Connection string (text secret)
          description: Text secret
      required:
        - textSecret
    AzureBlobAuthTypeClientSecret:
      type: object
      properties:
        authType:
          enum:
            - clientSecret
          type: string
        storageAccountName:
          type: string
          title: Storage account name
          description: The name of your Azure storage account
        tenantId:
          type: string
          title: Tenant ID
          description: The service principal's tenant ID
        clientId:
          type: string
          title: Client ID
          description: The service principal's client ID
        clientTextSecret:
          type: string
          title: Client secret (text secret)
          description: Text secret containing the client secret
        endpointSuffix:
          type: string
          title: Endpoint suffix
          description: The endpoint suffix for the service URL. Takes precedence over the
            Azure Cloud setting. Defaults to core.windows.net.
        azureCloud:
          type: string
          title: Azure Cloud
          description: The Azure cloud to use. Defaults to Azure Public Cloud.
        __template_storageAccountName:
          type: string
          description: Binds 'storageAccountName' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'storageAccountName' at runtime.
        __template_tenantId:
          type: string
          description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tenantId' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
        __template_endpointSuffix:
          type: string
          description: Binds 'endpointSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpointSuffix' at
            runtime.
        __template_azureCloud:
          type: string
          description: Binds 'azureCloud' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'azureCloud' at runtime.
      required:
        - storageAccountName
        - tenantId
        - clientId
        - clientTextSecret
    AzureBlobAuthTypeClientCert:
      type: object
      properties:
        authType:
          enum:
            - clientCert
          type: string
        storageAccountName:
          type: string
          title: Storage account name
          description: The name of your Azure storage account
        tenantId:
          type: string
          title: Tenant ID
          description: The service principal's tenant ID
        clientId:
          type: string
          title: Client ID
          description: The service principal's client ID
        certificate:
          $ref: "#/components/schemas/CertificateTypeAzureBlobAuthTypeClientCert"
        azureCloud:
          type: string
          title: Azure Cloud
          description: The Azure cloud to use. Defaults to Azure Public Cloud.
        endpointSuffix:
          type: string
          title: Endpoint suffix
          description: The endpoint suffix for the service URL. Takes precedence over the
            Azure Cloud setting. Defaults to core.windows.net.
      required:
        - storageAccountName
        - tenantId
        - clientId
        - certificate
    AzureBlobCollectorConf:
      type: object
      title: ""
      required:
        - containerName
      properties:
        outputName:
          type: string
          title: Auto-populate from
          description: An optional predefined Destination that will be used to
            auto-populate Collector settings
        authType:
          title: Authentication method
          type: string
          enum:
            - manual
            - secret
            - clientSecret
            - clientCert
          description: Enter authentication data directly, or select a secret referencing
            your auth data
          x-speakeasy-unknown-values: allow
        containerName:
          type: string
          title: Container name
          minLength: 1
          description: Container to collect from. This value can be a constant, or a
            JavaScript expression that can only be evaluated at init time.
            Example referencing a Global Variable: myBucket-${C.vars.myVar}
        path:
          type: string
          title: Path
          description: The directory from which to collect data. Templating is supported,
            such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are
            supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
          minLength: 1
        extractors:
          type: array
          title: Path extractors
          additionalProperties: false
          items:
            type: object
            required:
              - key
              - expression
            properties:
              key:
                type: string
                title: Token
                description: A token from the template path, such as epoch
              expression:
                type: string
                title: Extractor Expression
                description: "A JavaScript expression that accesses a corresponding
                  <token> through the value variable and evaluates the token to
                  populate event fields. Example: {date: new Date(+value*1000)}"
          description: 'Extractors allow use of template tokens as context for expressions
            that enrich discovery results. For example, given a template
            /path/${epoch}, an extractor under key "epoch" with an expression
            {date: new Date(+value*1000)} will enrich discovery results with a
            human-readable "date" field.'
        recurse:
          type: boolean
          title: Recursive
          description: Recurse through subdirectories
        includeMetadata:
          type: boolean
          title: Include metadata
          description: "Include Azure Blob metadata in collected events. In each event,
            metadata will be located at: __collectible.metadata."
        includeTags:
          type: boolean
          title: Include tags
          description: "Include Azure Blob tags in collected events. In each event, tags
            will be located at: __collectible.tags. Disable this feature when
            using a Shared Access Signature Connection String, to prevent
            errors."
        maxBatchSize:
          type: number
          title: Batch size limit
          description: Maximum number of metadata objects to batch before recording as
            results
          minimum: 1
        disableTimeFilter:
          type: boolean
          title: Disable time filter
          description: Disable Collector event time filtering when a date range is specified
        parquetChunkSizeMB:
          type: number
          title: Parquet chunk size limit
          description: Maximum file size for each Parquet chunk
          maximum: 100
          minimum: 1
        parquetChunkDownloadTimeout:
          type: number
          title: Parquet chunk download timeout (seconds)
          description: The maximum time allowed for downloading a Parquet chunk.
            Processing will abort if a chunk cannot be downloaded within the
            time specified.
          maximum: 3600
          minimum: 1
        connectionString:
          type: string
          title: Connection string
          description: Enter your Azure storage account Connection String. If left blank,
            Cribl Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING.
        __template_connectionString:
          type: string
          description: Binds 'connectionString' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'connectionString' at runtime.
        textSecret:
          type: string
          title: Connection string (text secret)
          description: Text secret
        storageAccountName:
          type: string
          title: Storage account name
          description: The name of your Azure storage account
        __template_storageAccountName:
          type: string
          description: Binds 'storageAccountName' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'storageAccountName' at runtime.
        tenantId:
          type: string
          title: Tenant ID
          description: The service principal's tenant ID
        __template_tenantId:
          type: string
          description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tenantId' at runtime.
        clientId:
          type: string
          title: Client ID
          description: The service principal's client ID
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
        clientTextSecret:
          type: string
          title: Client secret (text secret)
          description: Text secret containing the client secret
        endpointSuffix:
          type: string
          title: Endpoint suffix
          description: The endpoint suffix for the service URL. Takes precedence over the
            Azure Cloud setting. Defaults to core.windows.net.
        __template_endpointSuffix:
          type: string
          description: Binds 'endpointSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpointSuffix' at
            runtime.
        azureCloud:
          type: string
          title: Azure Cloud
          description: The Azure cloud to use. Defaults to Azure Public Cloud.
        __template_azureCloud:
          type: string
          description: Binds 'azureCloud' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'azureCloud' at runtime.
        certificate:
          $ref: "#/components/schemas/CertificateTypeAzureBlobAuthTypeClientCert"
        __template_containerName:
          type: string
          description: Binds 'containerName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'containerName' at runtime.
        __template_path:
          type: string
          description: Binds 'path' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'path' at runtime.
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/AzureBlobAuthTypeManual"
            - $ref: "#/components/schemas/AzureBlobAuthTypeSecret"
            - $ref: "#/components/schemas/AzureBlobAuthTypeClientSecret"
            - $ref: "#/components/schemas/AzureBlobAuthTypeClientCert"
          discriminator:
            propertyName: authType
            mapping:
              manual: "#/components/schemas/AzureBlobAuthTypeManual"
              secret: "#/components/schemas/AzureBlobAuthTypeSecret"
              clientSecret: "#/components/schemas/AzureBlobAuthTypeClientSecret"
              clientCert: "#/components/schemas/AzureBlobAuthTypeClientCert"
    CollectorAzureBlob:
      allOf:
        - $ref: "#/components/schemas/CollectorBase"
        - type: object
          properties:
            type:
              type: string
              enum:
                - azure_blob
              description: Collector type
            conf:
              $ref: "#/components/schemas/AzureBlobCollectorConf"
      description: AzureBlob collector configuration
    CriblLakeCollectorConf:
      type: object
      title: ""
      required:
        - dataset
      properties:
        storageLocationId:
          type: string
          title: Storage location
          description: Storage location for the Lake Dataset
        dataset:
          type: string
          title: Lake Dataset
          description: Lake dataset to collect data from.
        __template_dataset:
          type: string
          description: Binds 'dataset' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'dataset' at runtime.
    CollectorCriblLake:
      allOf:
        - $ref: "#/components/schemas/CollectorBase"
        - type: object
          properties:
            type:
              type: string
              enum:
                - cribl_lake
              description: Collector type
            conf:
              $ref: "#/components/schemas/CriblLakeCollectorConf"
      description: CriblLake collector configuration
    DatabaseCollectorConf:
      type: object
      title: ""
      required:
        - connectionId
        - query
      properties:
        connectionId:
          type: string
          title: Connection
          description: Select an existing Connection, or go to Knowledge > Database
            Connections to add one
        query:
          type: string
          title: SQL Query
          description: An expression that resolves to the query string for selecting data
            from the database. Has access to the special ${earliest} and
            ${latest} variables, which will resolve to the Collector run's start
            and end time.
          minLength: 1
        queryValidationEnabled:
          type: boolean
          title: Validate Query
          description: "Enforces a basic query validation that allows only a single
            'select' statement. Disable for more complex queries or when using
            semicolons. Caution: Disabling query validation allows DDL and DML
            statements to be executed, which could be destructive to your
            database."
        defaultBreakers:
          $ref: "#/components/schemas/HiddenDefaultBreakersOptionsDatabaseCollectorConf"
        __scheduling:
          type: object
          properties:
            stateTracking:
              type: object
              properties:
                enabled:
                  type: boolean
                  title: Enabled
                  description: Enable tracking of collection progress between consecutive
                    scheduled executions.
        __template_query:
          type: string
          description: Binds 'query' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'query' at runtime.
    CollectorDatabase:
      allOf:
        - $ref: "#/components/schemas/CollectorBase"
        - type: object
          properties:
            type:
              type: string
              enum:
                - database
              description: Collector type
            conf:
              $ref: "#/components/schemas/DatabaseCollectorConf"
      description: Database collector configuration
    FilesystemCollectorConf:
      type: object
      title: ""
      required:
        - path
      properties:
        outputName:
          type: string
          title: Auto-populate from
          description: Select a predefined configuration (a Destination) to auto-populate
            Collector settings
        path:
          type: string
          title: Directory
          description: The directory from which to collect data. Templating is supported,
            such as /myDir/${datacenter}/${host}/${app}/. Time-based tokens are
            also supported, such as
            /myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
          minLength: 1
        extractors:
          type: array
          title: Path extractors
          additionalProperties: false
          items:
            type: object
            required:
              - key
              - expression
            properties:
              key:
                type: string
                title: Token
                description: A token from the template directory, such as epoch
              expression:
                type: string
                title: Extractor expression
                description: 'JavaScript expression that receives token under "value" variable,
                  and evaluates to populate event fields, such as {date: new
                  Date(+value*1000)}'
          description: 'Allows using template tokens as context for expressions that
            enrich discovery results. For example, given a template
            /path/${epoch}, an extractor under key "epoch" with an expression
            {date: new Date(+value*1000)}, will enrich discovery results with a
            human readable "date" field.'
        recurse:
          type: boolean
          title: Recursive
          description: Recurse through subdirectories
        maxBatchSize:
          type: number
          title: Batch size limit (files)
          description: Maximum number of metadata files to batch before recording as results
          minimum: 1
        __template_path:
          type: string
          description: Binds 'path' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'path' at runtime.
    CollectorFilesystem:
      allOf:
        - $ref: "#/components/schemas/CollectorBase"
        - type: object
          properties:
            type:
              type: string
              enum:
                - filesystem
              description: Collector type
            conf:
              $ref: "#/components/schemas/FilesystemCollectorConf"
      description: Filesystem collector configuration
    GoogleCloudStorageAuthTypeAuto:
      type: object
      properties:
        authType:
          enum:
            - auto
          type: string
    GoogleCloudStorageAuthTypeManual:
      type: object
      properties:
        authType:
          enum:
            - manual
          type: string
        serviceAccountCredentials:
          type: string
          title: Service account credentials
          description: Contents of Google Cloud service account credentials (JSON keys)
            file. To upload a file, click the upload button at this field's
            upper right.
      required:
        - serviceAccountCredentials
    GoogleCloudStorageAuthTypeSecret:
      type: object
      properties:
        authType:
          enum:
            - secret
          type: string
        textSecret:
          type: string
          title: Service account credentials (text secret)
          description: Select or create a stored text secret that references your
            credentials
      required:
        - textSecret
    GoogleCloudStorageCollectorConf:
      type: object
      title: ""
      required:
        - bucket
      properties:
        outputName:
          type: string
          title: Auto-populate from
          description: Name of the predefined Destination that will be used to
            auto-populate Collector settings
        bucket:
          type: string
          title: Bucket name
          minLength: 1
          description: "Name of the bucket to collect from. This value can be a constant
            or a JavaScript expression that can only be evaluated at init time.
            Example referencing a Global Variable: `myBucket-${C.vars.myVar}`."
        path:
          type: string
          title: Path
          description: The directory from which to collect data. Templating is supported,
            such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are
            also supported, such as
            myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
          minLength: 1
        extractors:
          type: array
          title: Path extractors
          additionalProperties: false
          items:
            type: object
            required:
              - key
              - expression
            properties:
              key:
                type: string
                title: Token
                description: A token from the template path, such as epoch
              expression:
                type: string
                title: Extractor Expression
                description: 'JavaScript expression that receives token under "value" variable,
                  and evaluates to populate event fields, such as {date: new
                  Date(+value*1000)}'
          description: 'Allows using template tokens as context for expressions that
            enrich discovery results. For example, given a template
            /path/${epoch}, an extractor under key "epoch" with an expression
            {date: new Date(+value*1000)}, will enrich discovery results with a
            human readable "date" field.'
        endpoint:
          type: string
          title: Endpoint
          description: Google Cloud Storage service endpoint. If empty, the endpoint will
            default to https://storage.googleapis.com.
        disableTimeFilter:
          type: boolean
          title: Disable time filter
          description: Used to disable Collector event time filtering when a date range is
            specified
        recurse:
          type: boolean
          title: Recursive
          description: Recurse through subdirectories
        maxBatchSize:
          type: number
          title: Batch size limit (objects)
          description: Maximum number of metadata objects to batch before recording as
            results
          minimum: 1
        authType:
          title: Authentication method
          type: string
          enum:
            - auto
            - manual
            - secret
          description: Enter account credentials manually, select a secret that references
            your credentials, or use Google Application Default Credentials
          x-speakeasy-unknown-values: allow
        parquetChunkSizeMB:
          type: number
          title: Parquet chunk size limit (MB)
          description: Maximum file size for each Parquet chunk
          maximum: 100
          minimum: 1
        parquetChunkDownloadTimeout:
          type: number
          title: Parquet chunk download timeout (seconds)
          description: The maximum time allowed for downloading a Parquet chunk.
            Processing will abort if a chunk cannot be downloaded within the
            time specified.
          maximum: 3600
          minimum: 1
        serviceAccountCredentials:
          type: string
          title: Service account credentials
          description: Contents of Google Cloud service account credentials (JSON keys)
            file. To upload a file, click the upload button at this field's
            upper right.
        textSecret:
          type: string
          title: Service account credentials (text secret)
          description: Select or create a stored text secret that references your
            credentials
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_path:
          type: string
          description: Binds 'path' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'path' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/GoogleCloudStorageAuthTypeAuto"
            - $ref: "#/components/schemas/GoogleCloudStorageAuthTypeManual"
            - $ref: "#/components/schemas/GoogleCloudStorageAuthTypeSecret"
          discriminator:
            propertyName: authType
            mapping:
              auto: "#/components/schemas/GoogleCloudStorageAuthTypeAuto"
              manual: "#/components/schemas/GoogleCloudStorageAuthTypeManual"
              secret: "#/components/schemas/GoogleCloudStorageAuthTypeSecret"
    CollectorGoogleCloudStorage:
      allOf:
        - $ref: "#/components/schemas/CollectorBase"
        - type: object
          properties:
            type:
              type: string
              enum:
                - google_cloud_storage
              description: Collector type
            conf:
              $ref: "#/components/schemas/GoogleCloudStorageCollectorConf"
      description: GoogleCloudStorage collector configuration
    HealthCheckCollectMethodGet:
      type: object
      properties:
        collectMethod:
          enum:
            - get
          type: string
        collectRequestParams:
          title: Health check parameters
          description: Optional health check request parameters.
          type: array
          items:
            type: object
            required:
              - name
              - value
            properties:
              name:
                title: Name
                type: string
                description: Parameter name
              value:
                title: Value
                type: string
                description: JavaScript expression to compute the parameter value (can be a
                  constant).
    HealthCheckCollectMethodPost:
      type: object
      properties:
        collectMethod:
          enum:
            - post
          type: string
        collectRequestParams:
          title: Health check parameters
          description: Optional health check request parameters.
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfHealthCheckCollectMethodPost"
    HealthCheckCollectMethodPostWithBody:
      type: object
      properties:
        collectMethod:
          enum:
            - post_with_body
          type: string
        collectBody:
          type: string
          title: Health check POST Body
          description: "Template for POST body to send with the health check request. You
            can reference parameters from the Discover response, using template
            params of the form: ${variable}."
    HealthCheckAuthenticationNone:
      type: object
      properties:
        authentication:
          enum:
            - none
          type: string
    HealthCheckAuthenticationBasic:
      type: object
      properties:
        authentication:
          enum:
            - basic
          type: string
        username:
          type: string
          title: Username
          description: Basic authentication username
        password:
          type: string
          title: Password
          description: Basic authentication password
        __template_username:
          type: string
          description: Binds 'username' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'username' at runtime.
        __template_password:
          type: string
          description: Binds 'password' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'password' at runtime.
      required:
        - username
        - password
    HealthCheckAuthenticationBasicSecret:
      type: object
      properties:
        authentication:
          enum:
            - basicSecret
          type: string
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a stored secret that references your credentials
      required:
        - credentialsSecret
    HealthCheckAuthenticationLogin:
      type: object
      properties:
        authentication:
          enum:
            - login
          type: string
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for login API call. This call is expected to be a POST.
        username:
          type: string
          title: Username
          description: Login username
          minLength: 1
        password:
          type: string
          title: Password
          description: Login password
          minLength: 1
        loginBody:
          type: string
          title: POST body
          description: Template for POST body to send with login request, ${username} and
            ${password} are used to specify location of these attributes in the
            message
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are OK. Leave blank if the response content type is text/plain; the
            entire response body will be used to derive the authorization
            header.
        authHeaderExpr:
          type: string
          title: Authorize Expression
          description: JavaScript expression to compute the Authorization header to pass
            in discover and collect calls. The value ${token} is used to
            reference the token obtained from login.
        authRequestHeaders:
          title: Authentication Headers
          description: Optional authentication request headers.
          type: array
          items:
            $ref: "#/components/schemas/AuthRequestHeaderConfHealthCheckAuthenticationLogin"
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
        __template_username:
          type: string
          description: Binds 'username' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'username' at runtime.
        __template_password:
          type: string
          description: Binds 'password' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'password' at runtime.
        __template_tokenRespAttribute:
          type: string
          description: Binds 'tokenRespAttribute' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'tokenRespAttribute' at runtime.
      required:
        - loginUrl
        - username
        - password
        - loginBody
        - authHeaderExpr
    HealthCheckAuthenticationLoginSecret:
      type: object
      properties:
        authentication:
          enum:
            - loginSecret
          type: string
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for login API call, this call is expected to be a POST.
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a stored secret that references your login
            credentials
        loginBody:
          type: string
          title: POST body
          description: Template for POST body to send with login request, ${username} and
            ${password} are used to specify location of these attributes in the
            message
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are OK. If left blank, the entire response body will be used to
            derive the authorization header.
        authHeaderExpr:
          type: string
          title: Authorize Expression
          description: JavaScript expression to compute the Authorization header to pass
            in discover and collect calls. The value ${token} is used to
            reference the token obtained from login.
        authRequestHeaders:
          title: Authentication Headers
          description: Optional authentication request headers.
          type: array
          items:
            $ref: "#/components/schemas/AuthRequestHeaderConfHealthCheckAuthenticationLogin"
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
        __template_tokenRespAttribute:
          type: string
          description: Binds 'tokenRespAttribute' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'tokenRespAttribute' at runtime.
      required:
        - loginUrl
        - credentialsSecret
        - loginBody
        - authHeaderExpr
    HealthCheckAuthenticationOauth:
      type: object
      properties:
        authentication:
          enum:
            - oauth
          type: string
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for the OAuth API call. This call is expected to be a
            POST.
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are OK. Leave blank if the response content type is text/plain; the
            entire response body will be used to derive the authorization
            header.
        authHeaderExpr:
          type: string
          title: Authorize expression
          description: JavaScript expression to compute the Authorization header to pass
            in discover and collect calls. The value ${token} is used to
            reference the token obtained from login.
        clientSecretParamName:
          type: string
          title: Client secret parameter
          description: Parameter name that contains client secret. Defaults to
            'client_secret', and is automatically added to request parameters.
        clientSecretParamValue:
          type: string
          title: Client secret value
          description: Secret value to add to HTTP requests as the 'client secret'
            parameter. Stored on disk encrypted, and is automatically added to
            request parameters
        authRequestParams:
          title: Extra authentication parameters
          description: OAuth request parameters added to the POST body. The Content-Type
            header will automatically be set to
            application/x-www-form-urlencoded.
          type: array
          items:
            $ref: "#/components/schemas/AuthRequestParamConfHealthCheckAuthenticationOauth"
        authRequestHeaders:
          title: Authentication headers
          description: Optional authentication request headers.
          type: array
          items:
            $ref: "#/components/schemas/AuthRequestHeaderConfHealthCheckAuthenticationOauth"
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
        __template_tokenRespAttribute:
          type: string
          description: Binds 'tokenRespAttribute' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'tokenRespAttribute' at runtime.
      required:
        - loginUrl
        - clientSecretParamName
        - clientSecretParamValue
        - authHeaderExpr
    HealthCheckAuthenticationOauthSecret:
      type: object
      properties:
        authentication:
          enum:
            - oauthSecret
          type: string
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for the OAuth API call. This call is expected to be a
            POST.
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are OK. Leave blank if the response content type is text/plain; the
            entire response body will be used to derive the authorization
            header.
        authHeaderExpr:
          type: string
          title: Authorize expression
          description: JavaScript expression to compute the Authorization header to pass
            in discover and collect calls. The value ${token} is used to
            reference the token obtained from login.
        clientSecretParamName:
          type: string
          title: Client secret parameter
          description: Parameter name that contains client secret. Defaults to
            'client_secret', and is automatically added to request parameters.
        textSecret:
          type: string
          title: Client secret value (text secret)
          description: Select or create a text secret that contains the client secret's
            value.
        authRequestParams:
          title: Extra authentication parameters
          description: OAuth request parameters added to the POST body. The Content-Type
            header will automatically be set to
            application/x-www-form-urlencoded.
          type: array
          items:
            $ref: "#/components/schemas/AuthRequestParamConfHealthCheckAuthenticationOauth"
        authRequestHeaders:
          title: Authentication headers
          description: Optional authentication request headers.
          type: array
          items:
            $ref: "#/components/schemas/AuthRequestHeaderConfHealthCheckAuthenticationOauth"
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
        __template_tokenRespAttribute:
          type: string
          description: Binds 'tokenRespAttribute' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'tokenRespAttribute' at runtime.
      required:
        - loginUrl
        - clientSecretParamName
        - textSecret
        - authHeaderExpr
    HealthCheckDiscoveryDiscoverTypeHttpDiscoverMethodGet:
      type: object
      properties:
        discoverMethod:
          enum:
            - get
          type: string
        discoverRequestParams:
          title: Discover parameters
          description: Optional discover request parameters.
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfHealthCheckCollectMethodPost"
    HealthCheckDiscoveryDiscoverTypeHttpDiscoverMethodPost:
      type: object
      properties:
        discoverMethod:
          enum:
            - post
          type: string
        discoverRequestParams:
          title: Discover parameters
          description: Optional discover request parameters.
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfHealthCheckCollectMethodPost"
    HealthCheckDiscoveryDiscoverTypeHttpDiscoverMethodPostWithBody:
      type: object
      properties:
        discoverMethod:
          enum:
            - post_with_body
          type: string
        discoverBody:
          type: string
          title: Discover POST body
          description: Template for POST body to send with the discover request.
    HealthCheckDiscoveryDiscoverTypeHttp:
      type: object
      properties:
        discoverType:
          enum:
            - http
          type: string
        discoverUrl:
          type: string
          title: Discover URL
          description: Expression to derive URL to use for the Discover operation (can be
            a constant).
        discoverMethod:
          $ref: "#/components/schemas/DiscoverMethodOptionsHealthCheckDiscoveryDiscoverTy\
            peHttp"
        discoverRequestHeaders:
          title: Discover Headers
          description: Optional discover request headers.
          type: array
          items:
            $ref: "#/components/schemas/AuthRequestHeaderConfHealthCheckAuthenticationLogin"
        discoverDataField:
          type: string
          title: Discover Data Field
          description: "Path to field in the response object which contains discover
            results (e.g.: level1.name), leave blank if the result is an array."
        __template_discoverUrl:
          type: string
          description: Binds 'discoverUrl' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'discoverUrl' at runtime.
        __template_discoverDataField:
          type: string
          description: Binds 'discoverDataField' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'discoverDataField' at runtime.
      required:
        - discoverUrl
        - discoverMethod
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeHttpDiscoverMethodG\
                et"
            - $ref: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeHttpDiscoverMethodP\
                ost"
            - $ref: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeHttpDiscoverMethodP\
                ostWithBody"
          discriminator:
            propertyName: discoverMethod
            mapping:
              get: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeHttpDiscoverMethodGe\
                t"
              post: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeHttpDiscoverMethodP\
                ost"
              post_with_body: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeHttpDisco\
                verMethodPostWithBody"
    HealthCheckDiscoveryDiscoverTypeJson:
      type: object
      properties:
        discoverType:
          enum:
            - json
          type: string
        manualDiscoverResult:
          type: string
          title: Discover result
          description: Allows hard-coding the Discover result. Must be a JSON object.
            Works with the Discover Data field.
        discoverDataField:
          type: string
          title: Discover data field
          description: "Within the response JSON, name of the field or array element to
            pull results from. Leave blank if the result is an array of values.
            Sample entry: items, json: { items: [{id: 'first'},{id: 'second'}]
            }"
      required:
        - manualDiscoverResult
    HealthCheckDiscoveryDiscoverTypeList:
      type: object
      properties:
        discoverType:
          enum:
            - list
          type: string
        itemList:
          type: array
          title: Discover items
          description: Comma-separated list of items to return from the Discover task.
            Each item returned will generate a collect task, and can be
            referenced using `${id}` in the collect URL, headers, or parameters.
          minItems: 1
          items:
            type: string
            title: Items
            description: List of items to return from discovery.
      required:
        - itemList
    HealthCheckDiscoveryDiscoverTypeNone:
      type: object
      properties:
        discoverType:
          enum:
            - none
          type: string
    HealthCheckRetryRulesTypeNone:
      type: object
      properties:
        type:
          enum:
            - none
          type: string
    HealthCheckRetryRulesTypeStatic:
      type: object
      properties:
        type:
          enum:
            - static
          type: string
        interval:
          type: number
          title: Wait (ms)
          description: Time interval between retries. Maximum allowed value is 20,000 ms
            (1/3 minute).
          minimum: 0
          maximum: 20000
        limit:
          type: number
          title: Retry limit
          description: The maximum number of times to retry a failed HTTP request
          minimum: 0
          maximum: 20
        codes:
          type: array
          title: Retry HTTP codes
          description: List of HTTP codes that trigger a retry. Leave empty to use the
            default list of 429 and 503.
          minItems: 1
          items:
            type: number
            minLength: 1
        enableHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) or
            a timestamp after which to retry the request. The delay is limited
            to 20 seconds, even if the Retry-After header specifies a longer
            delay. When disabled, all Retry-After headers are ignored.
    HealthCheckRetryRulesTypeBackoff:
      type: object
      properties:
        type:
          enum:
            - backoff
          type: string
        interval:
          type: number
          title: Initial retry interval (ms)
          description: Time interval between failed request and first retry (kickoff).
            Maximum allowed value is 20,000 ms (1/3 minute).
          minimum: 0
          maximum: 20000
        limit:
          type: number
          title: Retry limit
          description: The maximum number of times to retry a failed HTTP request
          minimum: 0
          maximum: 20
        multiplier:
          type: number
          title: Backoff multiplier
          description: Base for exponential backoff, e.g., base 2 means that retries will
            occur after 2, then 4, then 8 seconds, and so on
          minimum: 1
          maximum: 20
        codes:
          type: array
          title: Retry HTTP codes
          description: List of HTTP codes that trigger a retry. Leave empty to use the
            default list of 429 and 503.
          minItems: 1
          items:
            type: number
            minLength: 1
        enableHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) or
            a timestamp after which to retry the request. The delay is limited
            to 20 seconds, even if the Retry-After header specifies a longer
            delay. When disabled, all Retry-After headers are ignored.
    HealthCheckCollectorConf:
      type: object
      title: ""
      required:
        - collectUrl
        - collectMethod
        - authentication
      properties:
        discovery:
          type: object
          required:
            - discoverType
          properties:
            discoverType:
              type: string
              title: Discover Type
              description: Defines how task discovery will be performed. Use None to skip the
                discovery. Use HTTP Request to make a REST call to discover
                tasks. Use Item List to enumerate items for collect to retrieve.
                Use JSON Response to manually define discover tasks as a JSON
                array of objects. Each entry returned by the discover operation
                will result in a collect task.
              enum:
                - http
                - json
                - list
                - none
              x-speakeasy-enum-descriptions:
                - HTTP Request
                - JSON Response
                - Item List
                - None
              x-speakeasy-unknown-values: allow
            discoverUrl:
              type: string
              title: Discover URL
              description: Expression to derive URL to use for the Discover operation (can be
                a constant).
            __template_discoverUrl:
              type: string
              description: Binds 'discoverUrl' to a variable for dynamic value resolution. Set
                to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'discoverUrl' at
                runtime.
            discoverMethod:
              $ref: "#/components/schemas/DiscoverMethodOptionsHealthCheckDiscoveryDiscoverTy\
                peHttp"
            discoverRequestHeaders:
              title: Discover Headers
              description: Optional discover request headers.
              type: array
              items:
                $ref: "#/components/schemas/AuthRequestHeaderConfHealthCheckAuthenticationLogin"
            discoverDataField:
              type: string
              title: Discover Data Field
              description: "Path to field in the response object which contains discover
                results (e.g.: level1.name), leave blank if the result is an
                array."
            __template_discoverDataField:
              type: string
              description: Binds 'discoverDataField' to a variable for dynamic value
                resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
                prefixed ID (group-scoped). Variable value overrides
                'discoverDataField' at runtime.
            manualDiscoverResult:
              type: string
              title: Discover result
              description: Allows hard-coding the Discover result. Must be a JSON object.
                Works with the Discover Data field.
            itemList:
              type: array
              title: Discover items
              description: Comma-separated list of items to return from the Discover task.
                Each item returned will generate a collect task, and can be
                referenced using `${id}` in the collect URL, headers, or
                parameters.
              minItems: 1
              items:
                type: string
                title: Items
                description: List of items to return from discovery.
          allOf:
            - oneOf:
                - $ref: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeHttp"
                - $ref: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeJson"
                - $ref: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeList"
                - $ref: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeNone"
              discriminator:
                propertyName: discoverType
                mapping:
                  http: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeHttp"
                  json: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeJson"
                  list: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeList"
                  none: "#/components/schemas/HealthCheckDiscoveryDiscoverTypeNone"
        collectUrl:
          type: string
          title: Health check URL
          description: Expression to derive URL to use for the health check operation (can
            be a constant).
        collectMethod:
          type: string
          title: Health check method
          description: Health check HTTP method.
          enum:
            - get
            - post
            - post_with_body
          x-speakeasy-enum-descriptions:
            - GET
            - POST
            - POST with Body
          x-speakeasy-unknown-values: allow
        collectRequestHeaders:
          title: Health check headers
          description: Optional health check request headers.
          type: array
          items:
            type: object
            required:
              - name
              - value
            properties:
              name:
                type: string
                title: Name
                description: Header Name
              value:
                type: string
                title: Value
                description: JavaScript expression to compute the header value (can be a
                  constant).
        authenticateCollect:
          type: boolean
          title: Authenticate health check
          description: Enable to make auth health check call.
        authentication:
          type: string
          title: Authentication
          description: Authentication method for Discover and Collect REST calls. You can
            specify API Key–based authentication by adding the appropriate
            Collect headers.
          enum:
            - none
            - basic
            - basicSecret
            - login
            - loginSecret
            - oauth
            - oauthSecret
          x-speakeasy-unknown-values: allow
        timeout:
          type: number
          title: Request Timeout (secs)
          description: HTTP request inactivity timeout, use 0 to disable
          minimum: 0
          maximum: 1800
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Whether to reject certificates that cannot be verified against a
            valid CA (e.g., self-signed certificates).
        defaultBreakers:
          $ref: "#/components/schemas/HiddenDefaultBreakersOptionsDatabaseCollectorConf"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text.
          items:
            type: string
        retryRules:
          type: object
          required:
            - type
          properties:
            type:
              $ref: "#/components/schemas/RetryTypeOptionsHealthCheckCollectorConfRetryRules"
          allOf:
            - oneOf:
                - $ref: "#/components/schemas/HealthCheckRetryRulesTypeNone"
                - $ref: "#/components/schemas/HealthCheckRetryRulesTypeStatic"
                - $ref: "#/components/schemas/HealthCheckRetryRulesTypeBackoff"
              discriminator:
                propertyName: type
                mapping:
                  none: "#/components/schemas/HealthCheckRetryRulesTypeNone"
                  static: "#/components/schemas/HealthCheckRetryRulesTypeStatic"
                  backoff: "#/components/schemas/HealthCheckRetryRulesTypeBackoff"
        username:
          type: string
          title: Username
          description: Basic authentication username
        __template_username:
          type: string
          description: Binds 'username' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'username' at runtime.
        password:
          type: string
          title: Password
          description: Basic authentication password
        __template_password:
          type: string
          description: Binds 'password' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'password' at runtime.
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a stored secret that references your credentials
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for login API call. This call is expected to be a POST.
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
        loginBody:
          type: string
          title: POST body
          description: Template for POST body to send with login request, ${username} and
            ${password} are used to specify location of these attributes in the
            message
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are OK. Leave blank if the response content type is text/plain; the
            entire response body will be used to derive the authorization
            header.
        __template_tokenRespAttribute:
          type: string
          description: Binds 'tokenRespAttribute' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'tokenRespAttribute' at runtime.
        authHeaderExpr:
          type: string
          title: Authorize Expression
          description: JavaScript expression to compute the Authorization header to pass
            in discover and collect calls. The value ${token} is used to
            reference the token obtained from login.
        authRequestHeaders:
          title: Authentication Headers
          description: Optional authentication request headers.
          type: array
          items:
            $ref: "#/components/schemas/AuthRequestHeaderConfHealthCheckAuthenticationLogin"
        clientSecretParamName:
          type: string
          title: Client secret parameter
          description: Parameter name that contains client secret. Defaults to
            'client_secret', and is automatically added to request parameters.
        clientSecretParamValue:
          type: string
          title: Client secret value
          description: Secret value to add to HTTP requests as the 'client secret'
            parameter. Stored on disk encrypted, and is automatically added to
            request parameters
        authRequestParams:
          title: Extra authentication parameters
          description: OAuth request parameters added to the POST body. The Content-Type
            header will automatically be set to
            application/x-www-form-urlencoded.
          type: array
          items:
            $ref: "#/components/schemas/AuthRequestParamConfHealthCheckAuthenticationOauth"
        textSecret:
          type: string
          title: Client secret value (text secret)
          description: Select or create a text secret that contains the client secret's
            value.
        __template_collectUrl:
          type: string
          description: Binds 'collectUrl' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'collectUrl' at runtime.
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/HealthCheckCollectMethodGet"
            - $ref: "#/components/schemas/HealthCheckCollectMethodPost"
            - $ref: "#/components/schemas/HealthCheckCollectMethodPostWithBody"
          discriminator:
            propertyName: collectMethod
            mapping:
              get: "#/components/schemas/HealthCheckCollectMethodGet"
              post: "#/components/schemas/HealthCheckCollectMethodPost"
              post_with_body: "#/components/schemas/HealthCheckCollectMethodPostWithBody"
        - oneOf:
            - $ref: "#/components/schemas/HealthCheckAuthenticationNone"
            - $ref: "#/components/schemas/HealthCheckAuthenticationBasic"
            - $ref: "#/components/schemas/HealthCheckAuthenticationBasicSecret"
            - $ref: "#/components/schemas/HealthCheckAuthenticationLogin"
            - $ref: "#/components/schemas/HealthCheckAuthenticationLoginSecret"
            - $ref: "#/components/schemas/HealthCheckAuthenticationOauth"
            - $ref: "#/components/schemas/HealthCheckAuthenticationOauthSecret"
          discriminator:
            propertyName: authentication
            mapping:
              none: "#/components/schemas/HealthCheckAuthenticationNone"
              basic: "#/components/schemas/HealthCheckAuthenticationBasic"
              basicSecret: "#/components/schemas/HealthCheckAuthenticationBasicSecret"
              login: "#/components/schemas/HealthCheckAuthenticationLogin"
              loginSecret: "#/components/schemas/HealthCheckAuthenticationLoginSecret"
              oauth: "#/components/schemas/HealthCheckAuthenticationOauth"
              oauthSecret: "#/components/schemas/HealthCheckAuthenticationOauthSecret"
    CollectorHealthCheck:
      allOf:
        - $ref: "#/components/schemas/CollectorBase"
        - type: object
          properties:
            type:
              type: string
              enum:
                - health_check
              description: Collector type
            conf:
              $ref: "#/components/schemas/HealthCheckCollectorConf"
      description: HealthCheck collector configuration
    RestCollectMethodGet:
      type: object
      properties:
        collectMethod:
          enum:
            - get
          type: string
        collectRequestParams:
          title: Collect parameters
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
    RestCollectMethodPost:
      type: object
      properties:
        collectMethod:
          enum:
            - post
          type: string
        collectRequestParams:
          title: Collect parameters
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
    RestCollectMethodPostWithBody:
      type: object
      properties:
        collectMethod:
          enum:
            - post_with_body
          type: string
        collectBody:
          type: string
          title: Collect POST body
          description: "Template for POST body to send with the Collect request. Reference
            global variables, functions, or parameters from the Discover
            response using template params: `${C.vars.myVar}`, or
            `${Date.now()}`, `${param}`"
      required:
        - collectBody
    RestCollectMethodOther:
      type: object
      properties:
        collectMethod:
          enum:
            - other
          type: string
        collectVerb:
          type: string
          title: Collect verb
          description: Custom HTTP method to use for the Collect operation
        collectBody:
          type: string
          title: Collect body
          description: "Template for body to send with the Collect request. Reference
            global variables, functions, or parameters from the Discover
            response using template parameters: `${C.vars.myVar}`, or
            `${Date.now()}`, `${param}`"
        collectRequestParams:
          title: Collect parameters
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
      required:
        - collectVerb
    RestAuthenticationNone:
      type: object
      properties:
        authentication:
          enum:
            - none
          type: string
    RestAuthenticationBasic:
      type: object
      properties:
        authentication:
          enum:
            - basic
          type: string
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
      required:
        - username
        - password
    RestAuthenticationBasicSecret:
      type: object
      properties:
        authentication:
          enum:
            - basicSecret
          type: string
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a stored secret that references your credentials
      required:
        - credentialsSecret
    RestAuthenticationLogin:
      type: object
      properties:
        authentication:
          enum:
            - login
          type: string
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for login API call. This call is expected to be a POST.
        username:
          type: string
          title: Login username
          minLength: 1
        password:
          type: string
          title: Login password
          minLength: 1
        loginBody:
          type: string
          title: POST body
          description: Template for POST body to send with login request. ${username} and
            ${password} are used to specify location of these attributes in the
            message. For x-www-form-urlencoded bodies, wrap values with
            ${C.Encode.uri(password)} to preserve special characters like +, &,
            and =.
        getAuthTokenFromHeader:
          type: boolean
          title: Get auth token from header
          description: Extract the auth token from the HTTP 'Authorization' response
            header instead of the standard JSON body of the login response
        authHeaderKey:
          type: string
          title: Authorization header
          description: Authorization header key to pass in Discover and Collect calls.
            Defaults to the literal name 'Authorization'.
        authHeaderExpr:
          type: string
          title: Authorize expression
          description: JavaScript expression used to compute the Authorization header to
            pass in Discover and Collect calls. The value ${token} is used to
            reference the token obtained from login.
        authRequestHeaders:
          title: Authentication headers
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are OK. Leave blank if the response content type is text/plain; the
            entire response body will be used to derive the authorization
            header.
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
        __template_username:
          type: string
          description: Binds 'username' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'username' at runtime.
        __template_password:
          type: string
          description: Binds 'password' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'password' at runtime.
      required:
        - loginUrl
        - username
        - password
        - loginBody
        - authHeaderExpr
    RestAuthenticationLoginSecret:
      type: object
      properties:
        authentication:
          enum:
            - loginSecret
          type: string
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for login API call. This call is expected to be a POST.
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a stored secret that references your login
            credentials
        loginBody:
          type: string
          title: POST body
          description: Template for POST body to send with login request. ${username} and
            ${password} are used to specify location of these attributes in the
            message. For x-www-form-urlencoded bodies, wrap values with
            ${C.Encode.uri(password)} to preserve special characters like +, &,
            and =.
        getAuthTokenFromHeader:
          type: boolean
          title: Get auth token from header
          description: Extract the auth token from the HTTP 'Authorization' response
            header instead of the standard JSON body of the login response
        authHeaderKey:
          type: string
          title: Authorization header
          description: Authorization header key to pass in Discover and Collect calls.
            Defaults to the literal name 'Authorization'.
        authHeaderExpr:
          type: string
          title: Authorize expression
          description: JavaScript expression to compute the Authorization header to pass
            in Discover and Collect calls. The value ${token} is used to
            reference the token obtained from login.
        authRequestHeaders:
          title: Authentication headers
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are OK. Leave blank if the response content type is text/plain; the
            entire response body will be used to derive the authorization
            header.
      required:
        - loginUrl
        - credentialsSecret
        - loginBody
        - authHeaderExpr
    RestAuthenticationOauth:
      type: object
      properties:
        authentication:
          enum:
            - oauth
          type: string
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for the OAuth API call. This call is expected to be a
            POST.
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are OK. Leave blank if the response content type is text/plain; the
            entire response body will be used to derive the authorization
            header.
        authHeaderKey:
          type: string
          title: Authorization header
          description: Authorization header key to pass in Discover and Collect calls.
            Defaults to the literal name 'Authorization'.
        authHeaderExpr:
          type: string
          title: Authorize expression
          description: JavaScript expression to compute the Authorization header to pass
            in Discover and Collect calls. The value ${token} is used to
            reference the token obtained from login.
        clientSecretParamName:
          type: string
          title: Client secret parameter
          description: Defaults to 'client_secret'. Automatically added to request
            parameters using the value specified.
        clientSecretParamValue:
          type: string
          title: Client secret value
          description: Secret value to add to HTTP requests as the 'client secret'
            parameter. Value is stored encrypted on disk and automatically added
            to request parameters.
        authRequestParams:
          title: Extra authentication parameters
          description: OAuth request parameters added to the POST body. The Content-Type
            header will automatically be set to
            application/x-www-form-urlencoded.
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
        authRequestHeaders:
          title: Authentication headers
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
        __template_clientSecretParamValue:
          type: string
          description: Binds 'clientSecretParamValue' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'clientSecretParamValue' at runtime.
      required:
        - loginUrl
        - clientSecretParamName
        - clientSecretParamValue
        - authHeaderExpr
    RestAuthenticationOauthSecret:
      type: object
      properties:
        authentication:
          enum:
            - oauthSecret
          type: string
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for the OAuth API call. This call is expected to be a
            POST.
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are OK. Leave blank if the response content type is text/plain; the
            entire response body will be used to derive the authorization
            header.
        authHeaderKey:
          type: string
          title: Authorization header
          description: Authorization header key to pass in Discover and Collect calls.
            Defaults to the literal name 'Authorization'.
        authHeaderExpr:
          type: string
          title: Authorize expression
          description: JavaScript expression to compute the Authorization header to pass
            in Discover and Collect calls. The value ${token} is used to
            reference the token obtained from login.
        clientSecretParamName:
          type: string
          title: Client secret parameter
          description: Defaults to 'client_secret'. Automatically added to request
            parameters using the value specified.
        textSecret:
          type: string
          title: Client secret value (text secret)
          description: Select or create a text secret that contains the client secret's
            value
        authRequestParams:
          title: Extra authentication parameters
          description: OAuth request parameters added to the POST body. The Content-Type
            header will automatically be set to
            application/x-www-form-urlencoded.
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
        authRequestHeaders:
          title: Authentication headers
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
      required:
        - loginUrl
        - clientSecretParamName
        - textSecret
        - authHeaderExpr
    RestAuthenticationGoogleOauth:
      type: object
      properties:
        authentication:
          enum:
            - google_oauth
          type: string
        scopes:
          type: array
          title: Scopes
          description: Scopes to use during authentication. See [Google's
            docs](https://developers.google.com/identity/protocols/oauth2/scopes)
            for more information.
          minItems: 1
          items:
            type: string
            minLength: 1
        serviceAccountCredentials:
          type: string
          title: Service account credentials
          description: Contents of Google Cloud service account credentials (JSON keys)
            file. To upload a file, click the upload icon in this field's upper
            right.
          minLength: 1
        subject:
          type: string
          title: Impersonated account's email address
          description: Email address of a user account with Super Admin permissions to the
            resources the collector will retrieve
        __template_serviceAccountCredentials:
          type: string
          description: Binds 'serviceAccountCredentials' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'serviceAccountCredentials' at runtime.
        __template_subject:
          type: string
          description: Binds 'subject' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'subject' at runtime.
      required:
        - scopes
        - serviceAccountCredentials
        - subject
    RestAuthenticationGoogleOauthSecret:
      type: object
      properties:
        authentication:
          enum:
            - google_oauthSecret
          type: string
        scopes:
          type: array
          title: Scopes
          description: Scopes to use during authentication. See [Google's
            docs](https://developers.google.com/identity/protocols/oauth2/scopes)
            for more information.
          minItems: 1
          items:
            type: string
            minLength: 1
        textSecret:
          type: string
          title: Service account credentials (text secret)
          description: Select or create a text secret that contains the Google service
            account credentials value
        subject:
          type: string
          title: Impersonated account's email address
          description: Email address of a user account with Super Admin permissions to the
            resources the collector will retrieve
        __template_subject:
          type: string
          description: Binds 'subject' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'subject' at runtime.
      required:
        - scopes
        - textSecret
        - subject
    RestAuthenticationHmac:
      type: object
      properties:
        authentication:
          enum:
            - hmac
          type: string
        hmacFunctionId:
          type: string
          title: HMAC Function
          description: Select or create an HMAC Function to use with authentication
      required:
        - hmacFunctionId
    RestDiscoveryDiscoverTypeHttpPaginationTypeNone:
      type: object
      properties:
        type:
          enum:
            - none
          type: string
    RestDiscoveryDiscoverTypeHttpPaginationTypeResponseBody:
      type: object
      properties:
        type:
          enum:
            - response_body
          type: string
        attribute:
          type:
            - array
            - string
          title: Response attributes
          description: Names of attributes within the response that contain next-page
            information
          items:
            type: string
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve for the discover task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
        lastPageExpr:
          type: string
          title: Last-page expression
          description: JavaScript expression used to determine when the last page has been
            reached. The values tested by this expression must be in the
            Response attributes section.
      required:
        - attribute
        - maxPages
    RestDiscoveryDiscoverTypeHttpPaginationTypeResponseHeader:
      type: object
      properties:
        type:
          enum:
            - response_header
          type: string
        attribute:
          type:
            - array
            - string
          title: Response attributes
          description: Names of attributes within the response that contain next-page
            information
          items:
            type: string
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve for the discover task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
      required:
        - attribute
        - maxPages
    RestDiscoveryDiscoverTypeHttpPaginationTypeResponseHeaderLink:
      type: object
      properties:
        type:
          enum:
            - response_header_link
          type: string
        nextRelationAttribute:
          type: string
          title: Next page relation name
          description: 'Relation name used in the link header that refers to the next page
            in the result set. Example: rel="next" refers to the next page of
            results: <https://myHost/nextPage>; rel="next"'
        curRelationAttribute:
          type: string
          title: Current page relation name
          description: 'Relation name used in the link header that refers to the current
            result set. Example: rel="self" refers to the current page of
            results: <https://myHost/curPage>; rel="self" '
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve for the discover task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
      required:
        - nextRelationAttribute
        - maxPages
    RestDiscoveryDiscoverTypeHttpPaginationTypeRequestOffset:
      type: object
      properties:
        type:
          enum:
            - request_offset
          type: string
        offsetField:
          type: string
          title: Offset field name
          description: "Query string parameter that sets the index from which to begin
            returning records. Example:
            /api/v1/query?term=cribl&limit=100&offset=0"
        offset:
          type: number
          title: Starting offset
          description: Offset index from which to start request. Defaults to undefined,
            which will start discovery from the first record.
        limitField:
          type: string
          title: Limit field name
          description: "Query string parameter that sets the number of records retrieved
            per request. Example: /api/v1/query?term=cribl&limit=100&offset=0"
        limit:
          type: number
          title: Record limit
          description: Maximum number of records to retrieve per request
          minimum: 1
        totalRecordField:
          type: string
          title: Total record count field name
          description: Name of the attribute in the response that contains the total
            number of records for the query
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve for the discover task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
        zeroIndexed:
          type: boolean
          title: Zero-based index
          description: Enable to indicate that the first page in the requested data is at
            index 0. Disabled by default, which indicates index 1.
      required:
        - maxPages
        - zeroIndexed
        - offsetField
        - limitField
        - limit
    RestDiscoveryDiscoverTypeHttpPaginationTypeRequestPage:
      type: object
      properties:
        type:
          enum:
            - request_page
          type: string
        pageField:
          type: string
          title: Page number field name
          description: "Query string parameter that sets the page index to be returned.
            Example: /api/v1/query?term=cribl&page_size=100&page_number=0"
        page:
          type: number
          title: Starting page number
          description: Page number from which to start request. Defaults to undefined,
            which will start discovery from the first page.
        sizeField:
          type: string
          title: Page size field name
          description: "Query string parameter that sets the number of records retrieved
            per request. Example:
            /api/v1/query?term=cribl&page_size=100&page_number=0"
        size:
          type: number
          title: Record limit
          description: Maximum number of records to retrieve per page
          minimum: 1
        totalPageField:
          type: string
          title: Total page count field name
          description: Name of the attribute in the response that contains the total
            number of pages for the query
        totalRecordField:
          type: string
          title: Total record count field name
          description: Name of the attribute in the response that contains the total
            number of records for the query
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve for the discover task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
        zeroIndexed:
          type: boolean
          title: Zero-based index
          description: Enable to indicate that the first page in the requested data is at
            index 0. Disabled by default, which indicates index 1.
      required:
        - maxPages
        - zeroIndexed
        - pageField
        - sizeField
        - size
    RestDiscoveryDiscoverTypeHttpDiscoverMethodGet:
      type: object
      properties:
        discoverMethod:
          enum:
            - get
          type: string
        discoverRequestParams:
          title: Discover parameters
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
    RestDiscoveryDiscoverTypeHttpDiscoverMethodPost:
      type: object
      properties:
        discoverMethod:
          enum:
            - post
          type: string
        discoverRequestParams:
          title: Discover parameters
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
    RestDiscoveryDiscoverTypeHttpDiscoverMethodPostWithBody:
      type: object
      properties:
        discoverMethod:
          enum:
            - post_with_body
          type: string
        discoverBody:
          type: string
          title: Discover POST body
          description: "Template for POST body to send with the discover request. To
            reference global variables or functions, use template parameters: `{
            myVar: ${C.vars.myVar}, secret: ${C.Secret('mySecret','text').value}
            }`"
      required:
        - discoverBody
    RestDiscoveryDiscoverTypeHttpDiscoverMethodOther:
      type: object
      properties:
        discoverMethod:
          enum:
            - other
          type: string
        discoverVerb:
          type: string
          title: Discover verb
          description: Custom HTTP method to use for the Discover operation
        discoverBody:
          type: string
          title: Discover body
          description: Template for body to send with the discover request
        discoverRequestParams:
          title: Discover parameters
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
      required:
        - discoverVerb
    RestDiscoveryDiscoverTypeHttp:
      type: object
      properties:
        discoverType:
          enum:
            - http
          type: string
        discoverUrl:
          type: string
          title: Discover URL
          description: URL to use for the Discover operation. Can be a constant URL, or a
            JavaScript expression to derive the URL.
        discoverMethod:
          $ref: "#/components/schemas/DiscoverMethodOptionsRestDiscoveryDiscoverTypeHttp"
        discoverRequestHeaders:
          title: Discover headers
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
        pagination:
          $ref: "#/components/schemas/PaginationTypeRestDiscoveryDiscoverTypeHttp"
        discoverDataField:
          type: string
          title: Discover data field
          description: "Path to field in the response object that contains discovery
            results (ex: level1.name). Leave blank if the result is an array."
        enableStrictDiscoverParsing:
          type: boolean
          title: Strict discover response parsing
          description: Explicitly set the discover response format. When disabled, best
            effort parsing is used.
        discoverResponseFormat:
          type: string
          title: Discover response format
          description: If 'Strict discover response parsing' parsing is enabled, provide
            the response format
        enableDiscoverCode:
          type: boolean
          title: Format discover result with custom code
        formatResultCode:
          type: string
          title: Format discover result
          description: "Custom JavaScript code to format the discover result through the
            __e variable which is a JSON object or array containing the original
            discover results. The object or array passed should be manipulated
            to contain the desired discover results, i.e.: __e['myResult'] =
            [{lat: -1.1234, long: 2.345, zip: 11111},{lat: -1.235, long 2.346,
            zip: 22222}] or ['11111','22222']. Caution: This function is
            evaluated in an unprotected context, allowing you to execute almost
            any JavaScript code."
        __template_discoverUrl:
          type: string
          description: Binds 'discoverUrl' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'discoverUrl' at runtime.
      required:
        - discoverUrl
        - discoverMethod
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpDiscoverMethodGet"
            - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpDiscoverMethodPost"
            - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpDiscoverMethodPostWith\
                Body"
            - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpDiscoverMethodOther"
          discriminator:
            propertyName: discoverMethod
            mapping:
              get: "#/components/schemas/RestDiscoveryDiscoverTypeHttpDiscoverMethodGet"
              post: "#/components/schemas/RestDiscoveryDiscoverTypeHttpDiscoverMethodPost"
              post_with_body: "#/components/schemas/RestDiscoveryDiscoverTypeHttpDiscoverMeth\
                odPostWithBody"
              other: "#/components/schemas/RestDiscoveryDiscoverTypeHttpDiscoverMethodOther"
    RestDiscoveryDiscoverTypeJson:
      type: object
      properties:
        discoverType:
          enum:
            - json
          type: string
        manualDiscoverResult:
          type: string
          title: Discover result
          description: Allows hard-coding the Discover result. Must be a JSON object or
            array. Works with Discover data field.
        discoverDataField:
          type: string
          title: Discover data field
          description: "Within the response JSON, the name of the field to pull results
            from, typically a JSON array. Leave blank if the result itself is an
            array of values. Sample entry: items, json: { items: [{id:
            'first'},{id: 'second'}] }"
      required:
        - manualDiscoverResult
    RestDiscoveryDiscoverTypeList:
      type: object
      properties:
        discoverType:
          enum:
            - list
          type: string
        itemList:
          type: array
          title: Discover items
          description: Comma-separated list of items to return from the Discover task.
            Each item returned generates a Collect task and can be referenced
            using `${id}` in the Collect URL, headers, or parameters.
          minItems: 1
          items:
            type: string
            title: Items
            description: List of items to return from discovery
      required:
        - itemList
    RestDiscoveryDiscoverTypeNone:
      type: object
      properties:
        discoverType:
          enum:
            - none
          type: string
    RestPaginationTypeNone:
      type: object
      properties:
        type:
          enum:
            - none
          type: string
    RestPaginationTypeResponseBody:
      type: object
      properties:
        type:
          enum:
            - response_body
          type: string
        attribute:
          type:
            - array
            - string
          title: Response attributes
          description: Names of attributes within the response that contain next-page
            information
          items:
            type: string
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve per collection task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
        lastPageExpr:
          type: string
          title: Last-page expression
          description: JavaScript expression used to determine when the last page has been
            reached. The values tested by this expression must be in the
            Response attributes section.
      required:
        - attribute
        - maxPages
    RestPaginationTypeResponseHeader:
      type: object
      properties:
        type:
          enum:
            - response_header
          type: string
        attribute:
          type:
            - array
            - string
          title: Response attributes
          description: Names of attributes within the response that contain next-page
            information
          items:
            type: string
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve per collection task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
      required:
        - attribute
        - maxPages
    RestPaginationTypeResponseHeaderLink:
      type: object
      properties:
        type:
          enum:
            - response_header_link
          type: string
        nextRelationAttribute:
          type: string
          title: Next page relation name
          description: 'Relation name used in the link header that refers to the next page
            in the result set. Example: rel="next" refers to the next page of
            results: <https://myHost/nextPage>; rel="next"'
        curRelationAttribute:
          type: string
          title: Current page relation name
          description: 'Relation name used in the link header that refers to the current
            result set. Example: rel="self" refers to the current page of
            results: <https://myHost/curPage>; rel="self" '
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve per collection task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
      required:
        - nextRelationAttribute
        - maxPages
    RestPaginationTypeRequestOffset:
      type: object
      properties:
        type:
          enum:
            - request_offset
          type: string
        offsetField:
          type: string
          title: Offset field name
          description: "Query string parameter that sets the index from which to begin
            returning records. Example:
            /api/v1/query?term=cribl&limit=100&offset=0"
        offset:
          type: number
          title: Starting offset
          description: Offset index from which to start request. Defaults to undefined,
            which will start collection from the first record.
        limitField:
          type: string
          title: Limit field name
          description: "Query string parameter that sets the number of records retrieved
            per request. Example: /api/v1/query?term=cribl&limit=100&offset=0"
        limit:
          type: number
          title: Record limit
          description: Maximum number of records to collect per request
          minimum: 1
        totalRecordField:
          type: string
          title: Total record count field name
          description: Name of the attribute in the response that contains the total
            number of records for the query
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve per collection task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
        zeroIndexed:
          type: boolean
          title: Zero-based index
          description: Enable to indicate that the first page in the requested data is at
            index 0. Disabled by default, which indicates index 1.
      required:
        - maxPages
        - zeroIndexed
        - offsetField
        - limitField
        - limit
    RestPaginationTypeRequestPage:
      type: object
      properties:
        type:
          enum:
            - request_page
          type: string
        pageField:
          type: string
          title: Page number field name
          description: "Query string parameter that sets the page index to be returned.
            Example: /api/v1/query?term=cribl&page_size=100&page_number=0"
        page:
          type: number
          title: Starting page number
          description: Page number from which to start request. Defaults to undefined,
            which will start collection from the first page.
        sizeField:
          type: string
          title: Page size field name
          description: "Query string parameter that sets the number of records retrieved
            per request. Example:
            /api/v1/query?term=cribl&page_size=100&page_number=0"
        size:
          type: number
          title: Record limit
          description: Maximum number of records to collect per page
          minimum: 1
        totalPageField:
          type: string
          title: Total page count field name
          description: Name of the attribute in the response that contains the total
            number of pages for the query
        totalRecordField:
          type: string
          title: Total record count field name
          description: Name of the attribute in the response that contains the total
            number of records for the query
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve per collection task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
        zeroIndexed:
          type: boolean
          title: Zero-based index
          description: Enable to indicate that the first page in the requested data is at
            index 0. Disabled by default, which indicates index 1.
      required:
        - maxPages
        - zeroIndexed
        - pageField
        - sizeField
        - size
    RestRetryRulesTypeNone:
      type: object
      properties:
        type:
          enum:
            - none
          type: string
    RestRetryRulesTypeStatic:
      type: object
      properties:
        type:
          enum:
            - static
          type: string
        interval:
          type: number
          title: Wait (ms)
          description: Time interval between retries. Maximum allowed value is 20,000 ms
            (1/3 minute).
          minimum: 0
          maximum: 20000
        limit:
          type: number
          title: Retry limit
          description: Maximum number of times to retry a failed HTTP request
          minimum: 0
          maximum: 20
        codes:
          type: array
          title: Retry HTTP codes
          description: List of HTTP codes that trigger a retry. Leave empty to use the
            default list of 429 and 503.
          minItems: 1
          items:
            type: number
            minLength: 1
        enableHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) or
            a timestamp after which to retry the request. The delay is limited
            to the `Longest interval between retries (ms)` value, even if the
            Retry-After header specifies a longer delay. When disabled, all
            Retry-After headers are ignored.
        retryConnectTimeout:
          type: boolean
          title: Retry connection timeout
          description: Make a single retry attempt when a connection timeout (ETIMEDOUT)
            error occurs
        retryConnectReset:
          type: boolean
          title: Retry connection reset
          description: Retry request when a connection reset (ECONNRESET) error occurs
        retryHeaderName:
          type: string
          title: Retry-After header name
    RestRetryRulesTypeBackoff:
      type: object
      properties:
        type:
          enum:
            - backoff
          type: string
        interval:
          type: number
          title: Initial retry interval (ms)
          description: Time interval between a failed request and the first retry
          minimum: 0
          maximum: 20000
        limit:
          type: number
          title: Retry limit
          description: Maximum number of times to retry a failed HTTP request
          minimum: 0
          maximum: 20
        multiplier:
          type: number
          title: Backoff multiplier
          description: "Base for exponential backoff. Example: base 2 means that retries
            will occur after 2, then 4, then 8 seconds, and so on."
          minimum: 1
          maximum: 20
        maxIntervalMs:
          type: number
          title: Longest interval between retries (ms)
          minimum: 0
        codes:
          type: array
          title: Retry HTTP codes
          description: List of HTTP codes that trigger a retry. Leave empty to use the
            default list of 429 and 503.
          minItems: 1
          items:
            type: number
            minLength: 1
        enableHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) or
            a timestamp after which to retry the request. The delay is limited
            to the `Longest interval between retries (ms)` value, even if the
            Retry-After header specifies a longer delay. When disabled, all
            Retry-After headers are ignored.
        retryConnectTimeout:
          type: boolean
          title: Retry connection timeout
          description: Make a single retry attempt when a connection timeout (ETIMEDOUT)
            error occurs
        retryConnectReset:
          type: boolean
          title: Retry connection reset
          description: Retry request when a connection reset (ECONNRESET) error occurs
        retryHeaderName:
          type: string
          title: Retry-After header name
    RestCollectorConf:
      type: object
      title: ""
      required:
        - collectUrl
        - collectMethod
        - authentication
      properties:
        discovery:
          type: object
          required:
            - discoverType
          properties:
            discoverType:
              type: string
              title: Discover type
              description: Defines how task discovery will be performed. Each entry returned
                by the Discover operation will result in a Collect task.
              enum:
                - http
                - json
                - list
                - none
              x-speakeasy-unknown-values: allow
            discoverUrl:
              type: string
              title: Discover URL
              description: URL to use for the Discover operation. Can be a constant URL, or a
                JavaScript expression to derive the URL.
            __template_discoverUrl:
              type: string
              description: Binds 'discoverUrl' to a variable for dynamic value resolution. Set
                to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'discoverUrl' at
                runtime.
            discoverMethod:
              $ref: "#/components/schemas/DiscoverMethodOptionsRestDiscoveryDiscoverTypeHttp"
            discoverRequestHeaders:
              title: Discover headers
              type: array
              items:
                $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
            pagination:
              $ref: "#/components/schemas/PaginationTypeRestDiscoveryDiscoverTypeHttp"
            discoverDataField:
              type: string
              title: Discover data field
              description: "Path to field in the response object that contains discovery
                results (ex: level1.name). Leave blank if the result is an
                array."
            enableStrictDiscoverParsing:
              type: boolean
              title: Strict discover response parsing
              description: Explicitly set the discover response format. When disabled, best
                effort parsing is used.
            enableDiscoverCode:
              type: boolean
              title: Format discover result with custom code
            manualDiscoverResult:
              type: string
              title: Discover result
              description: Allows hard-coding the Discover result. Must be a JSON object or
                array. Works with Discover data field.
            itemList:
              type: array
              title: Discover items
              description: Comma-separated list of items to return from the Discover task.
                Each item returned generates a Collect task and can be
                referenced using `${id}` in the Collect URL, headers, or
                parameters.
              minItems: 1
              items:
                type: string
                title: Items
                description: List of items to return from discovery
          allOf:
            - oneOf:
                - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttp"
                - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeJson"
                - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeList"
                - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeNone"
              discriminator:
                propertyName: discoverType
                mapping:
                  http: "#/components/schemas/RestDiscoveryDiscoverTypeHttp"
                  json: "#/components/schemas/RestDiscoveryDiscoverTypeJson"
                  list: "#/components/schemas/RestDiscoveryDiscoverTypeList"
                  none: "#/components/schemas/RestDiscoveryDiscoverTypeNone"
        collectUrl:
          type: string
          title: Collect URL
          description: URL (constant or JavaScript expression) to use for the Collect
            operation
        collectMethod:
          type: string
          title: Collect method
          enum:
            - get
            - post
            - post_with_body
            - other
          x-speakeasy-enum-descriptions:
            - GET
            - POST
            - POST with Body
            - Other
          x-speakeasy-unknown-values: allow
        collectRequestHeaders:
          title: Collect headers
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
        pagination:
          type: object
          required:
            - type
          properties:
            type:
              $ref: "#/components/schemas/PaginationOptionsRestDiscoveryDiscoverTypeHttpPagin\
                ation"
            maxPages:
              type: number
              title: Page limit
              description: Maximum number of pages to retrieve per collection task. Defaults
                to 50 pages. Set to 0 to retrieve all pages.
              minimum: 0
            lastPageExpr:
              type: string
              title: Last-page expression
              description: JavaScript expression used to determine when the last page has been
                reached. The values tested by this expression must be in the
                Response attributes section.
            nextRelationAttribute:
              type: string
              title: Next page relation name
              description: 'Relation name used in the link header that refers to the next page
                in the result set. Example: rel="next" refers to the next page
                of results: <https://myHost/nextPage>; rel="next"'
            curRelationAttribute:
              type: string
              title: Current page relation name
              description: 'Relation name used in the link header that refers to the current
                result set. Example: rel="self" refers to the current page of
                results: <https://myHost/curPage>; rel="self" '
            offsetField:
              type: string
              title: Offset field name
              description: "Query string parameter that sets the index from which to begin
                returning records. Example:
                /api/v1/query?term=cribl&limit=100&offset=0"
            offset:
              type: number
              title: Starting offset
              description: Offset index from which to start request. Defaults to undefined,
                which will start collection from the first record.
            limitField:
              type: string
              title: Limit field name
              description: "Query string parameter that sets the number of records retrieved
                per request. Example:
                /api/v1/query?term=cribl&limit=100&offset=0"
            limit:
              type: number
              title: Record limit
              description: Maximum number of records to collect per request
              minimum: 1
            totalRecordField:
              type: string
              title: Total record count field name
              description: Name of the attribute in the response that contains the total
                number of records for the query
            zeroIndexed:
              type: boolean
              title: Zero-based index
              description: Enable to indicate that the first page in the requested data is at
                index 0. Disabled by default, which indicates index 1.
            pageField:
              type: string
              title: Page number field name
              description: "Query string parameter that sets the page index to be returned.
                Example: /api/v1/query?term=cribl&page_size=100&page_number=0"
            page:
              type: number
              title: Starting page number
              description: Page number from which to start request. Defaults to undefined,
                which will start collection from the first page.
            sizeField:
              type: string
              title: Page size field name
              description: "Query string parameter that sets the number of records retrieved
                per request. Example:
                /api/v1/query?term=cribl&page_size=100&page_number=0"
            size:
              type: number
              title: Record limit
              description: Maximum number of records to collect per page
              minimum: 1
            totalPageField:
              type: string
              title: Total page count field name
              description: Name of the attribute in the response that contains the total
                number of pages for the query
          allOf:
            - oneOf:
                - $ref: "#/components/schemas/RestPaginationTypeNone"
                - $ref: "#/components/schemas/RestPaginationTypeResponseBody"
                - $ref: "#/components/schemas/RestPaginationTypeResponseHeader"
                - $ref: "#/components/schemas/RestPaginationTypeResponseHeaderLink"
                - $ref: "#/components/schemas/RestPaginationTypeRequestOffset"
                - $ref: "#/components/schemas/RestPaginationTypeRequestPage"
              discriminator:
                propertyName: type
                mapping:
                  none: "#/components/schemas/RestPaginationTypeNone"
                  response_body: "#/components/schemas/RestPaginationTypeResponseBody"
                  response_header: "#/components/schemas/RestPaginationTypeResponseHeader"
                  response_header_link: "#/components/schemas/RestPaginationTypeResponseHeaderLink"
                  request_offset: "#/components/schemas/RestPaginationTypeRequestOffset"
                  request_page: "#/components/schemas/RestPaginationTypeRequestPage"
        authentication:
          type: string
          title: Authentication
          description: Authentication method for Discover and Collect REST calls. You can
            specify API key–based authentication by adding the appropriate
            Collect headers.
          enum:
            - none
            - basic
            - basicSecret
            - login
            - loginSecret
            - oauth
            - oauthSecret
            - google_oauth
            - google_oauthSecret
            - hmac
          x-speakeasy-unknown-values: allow
        timeout:
          type: number
          title: Request timeout (secs)
          description: HTTP request inactivity timeout. Use 0 to disable.
          minimum: 0
          maximum: 1800
        maxResponseBodySize:
          type: string
          title: Max response body size
          description: Maximum amount of data to buffer from a single response body.
            Responses exceeding this limit will be rejected. Maximum allowed
            value is 512 MB. Leave unset to rely on default error handling.
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Use round-robin DNS lookup. Suitable when DNS server returns
            multiple addresses in sort order.
        disableTimeFilter:
          type: boolean
          title: Disable time filter
          description: Disable Collector event time filtering when a date range is specified
        decodeUrl:
          type: boolean
          title: Decode URL
          description: Decode the URL before sending requests (including pagination
            requests)
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA
            (such as self-signed certificates)
        captureHeaders:
          type: boolean
          title: Capture response headers
          description: Enable to add response headers to the resHeaders field under the
            __collectible object
        stopOnEmptyResults:
          type: boolean
          title: Stop on empty results
          description: Stop pagination when the Event Breaker produces no events
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        retryRules:
          type: object
          required:
            - type
          properties:
            type:
              $ref: "#/components/schemas/RetryTypeOptionsHealthCheckCollectorConfRetryRules"
          allOf:
            - oneOf:
                - $ref: "#/components/schemas/RestRetryRulesTypeNone"
                - $ref: "#/components/schemas/RestRetryRulesTypeStatic"
                - $ref: "#/components/schemas/RestRetryRulesTypeBackoff"
              discriminator:
                propertyName: type
                mapping:
                  none: "#/components/schemas/RestRetryRulesTypeNone"
                  static: "#/components/schemas/RestRetryRulesTypeStatic"
                  backoff: "#/components/schemas/RestRetryRulesTypeBackoff"
        microsoftGraphDelta:
          type: object
          description: Internal opt-in for the Microsoft Graph deltaLink state-tracking
            hook. Set programmatically by the Microsoft Graph source when the
            configured URL targets a /delta endpoint; not user-configurable.
          properties:
            deltaLinkAttribute:
              type: string
              description: Response-body field name to extract as the delta link (typically
                '@odata.deltaLink')
        __scheduling:
          type: object
          properties:
            stateTracking:
              type: object
              properties:
                enabled:
                  type: boolean
                  title: Enabled
                  description: Track collection progress between consecutive scheduled executions
        username:
          type: string
          title: Username
        __template_username:
          type: string
          description: Binds 'username' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'username' at runtime.
        password:
          type: string
          title: Password
        __template_password:
          type: string
          description: Binds 'password' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'password' at runtime.
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a stored secret that references your credentials
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for login API call. This call is expected to be a POST.
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
        loginBody:
          type: string
          title: POST body
          description: Template for POST body to send with login request. ${username} and
            ${password} are used to specify location of these attributes in the
            message. For x-www-form-urlencoded bodies, wrap values with
            ${C.Encode.uri(password)} to preserve special characters like +, &,
            and =.
        getAuthTokenFromHeader:
          type: boolean
          title: Get auth token from header
          description: Extract the auth token from the HTTP 'Authorization' response
            header instead of the standard JSON body of the login response
        authHeaderKey:
          type: string
          title: Authorization header
          description: Authorization header key to pass in Discover and Collect calls.
            Defaults to the literal name 'Authorization'.
        authHeaderExpr:
          type: string
          title: Authorize expression
          description: JavaScript expression used to compute the Authorization header to
            pass in Discover and Collect calls. The value ${token} is used to
            reference the token obtained from login.
        authRequestHeaders:
          title: Authentication headers
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are OK. Leave blank if the response content type is text/plain; the
            entire response body will be used to derive the authorization
            header.
        clientSecretParamName:
          type: string
          title: Client secret parameter
          description: Defaults to 'client_secret'. Automatically added to request
            parameters using the value specified.
        clientSecretParamValue:
          type: string
          title: Client secret value
          description: Secret value to add to HTTP requests as the 'client secret'
            parameter. Value is stored encrypted on disk and automatically added
            to request parameters.
        __template_clientSecretParamValue:
          type: string
          description: Binds 'clientSecretParamValue' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'clientSecretParamValue' at runtime.
        authRequestParams:
          title: Extra authentication parameters
          description: OAuth request parameters added to the POST body. The Content-Type
            header will automatically be set to
            application/x-www-form-urlencoded.
          type: array
          items:
            $ref: "#/components/schemas/CollectRequestParamConfRestCollectMethodGet"
        textSecret:
          type: string
          title: Client secret value (text secret)
          description: Select or create a text secret that contains the client secret's
            value
        scopes:
          type: array
          title: Scopes
          description: Scopes to use during authentication. See [Google's
            docs](https://developers.google.com/identity/protocols/oauth2/scopes)
            for more information.
          minItems: 1
          items:
            type: string
            minLength: 1
        serviceAccountCredentials:
          type: string
          title: Service account credentials
          description: Contents of Google Cloud service account credentials (JSON keys)
            file. To upload a file, click the upload icon in this field's upper
            right.
          minLength: 1
        __template_serviceAccountCredentials:
          type: string
          description: Binds 'serviceAccountCredentials' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'serviceAccountCredentials' at runtime.
        subject:
          type: string
          title: Impersonated account's email address
          description: Email address of a user account with Super Admin permissions to the
            resources the collector will retrieve
        __template_subject:
          type: string
          description: Binds 'subject' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'subject' at runtime.
        hmacFunctionId:
          type: string
          title: HMAC Function
          description: Select or create an HMAC Function to use with authentication
        __template_collectUrl:
          type: string
          description: Binds 'collectUrl' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'collectUrl' at runtime.
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/RestCollectMethodGet"
            - $ref: "#/components/schemas/RestCollectMethodPost"
            - $ref: "#/components/schemas/RestCollectMethodPostWithBody"
            - $ref: "#/components/schemas/RestCollectMethodOther"
          discriminator:
            propertyName: collectMethod
            mapping:
              get: "#/components/schemas/RestCollectMethodGet"
              post: "#/components/schemas/RestCollectMethodPost"
              post_with_body: "#/components/schemas/RestCollectMethodPostWithBody"
              other: "#/components/schemas/RestCollectMethodOther"
        - oneOf:
            - $ref: "#/components/schemas/RestAuthenticationNone"
            - $ref: "#/components/schemas/RestAuthenticationBasic"
            - $ref: "#/components/schemas/RestAuthenticationBasicSecret"
            - $ref: "#/components/schemas/RestAuthenticationLogin"
            - $ref: "#/components/schemas/RestAuthenticationLoginSecret"
            - $ref: "#/components/schemas/RestAuthenticationOauth"
            - $ref: "#/components/schemas/RestAuthenticationOauthSecret"
            - $ref: "#/components/schemas/RestAuthenticationGoogleOauth"
            - $ref: "#/components/schemas/RestAuthenticationGoogleOauthSecret"
            - $ref: "#/components/schemas/RestAuthenticationHmac"
          discriminator:
            propertyName: authentication
            mapping:
              none: "#/components/schemas/RestAuthenticationNone"
              basic: "#/components/schemas/RestAuthenticationBasic"
              basicSecret: "#/components/schemas/RestAuthenticationBasicSecret"
              login: "#/components/schemas/RestAuthenticationLogin"
              loginSecret: "#/components/schemas/RestAuthenticationLoginSecret"
              oauth: "#/components/schemas/RestAuthenticationOauth"
              oauthSecret: "#/components/schemas/RestAuthenticationOauthSecret"
              google_oauth: "#/components/schemas/RestAuthenticationGoogleOauth"
              google_oauthSecret: "#/components/schemas/RestAuthenticationGoogleOauthSecret"
              hmac: "#/components/schemas/RestAuthenticationHmac"
    CollectorRest:
      allOf:
        - $ref: "#/components/schemas/CollectorBase"
        - type: object
          properties:
            type:
              type: string
              enum:
                - rest
              description: Collector type
            conf:
              $ref: "#/components/schemas/RestCollectorConf"
      description: Rest collector configuration
    S3PartitioningSchemeDdss:
      type: object
      properties:
        partitioningScheme:
          enum:
            - ddss
          type: string
    S3PartitioningSchemeNone:
      type: object
      properties:
        partitioningScheme:
          enum:
            - none
          type: string
        recurse:
          type: boolean
          title: Recursive
          description: Traverse and include files from subdirectories. Leave this option
            enabled to ensure that all nested directories are searched and their
            contents collected.
    S3AwsAuthenticationMethodAuto:
      type: object
      properties:
        awsAuthenticationMethod:
          enum:
            - auto
          type: string
    S3AwsAuthenticationMethodManual:
      type: object
      properties:
        awsAuthenticationMethod:
          enum:
            - manual
          type: string
        awsApiKey:
          type: string
          title: Access key
          description: Access key. If not present, will fall back to
            env.AWS_ACCESS_KEY_ID, or to the metadata endpoint for IAM creds.
            Optional when running on AWS. This value can be a constant or a
            JavaScript expression.
        awsSecretKey:
          type: string
          title: Secret key
          description: Secret key. If not present, will fall back to
            env.AWS_SECRET_ACCESS_KEY, or to the metadata endpoint for IAM
            creds. Optional when running on AWS. This value can be a constant or
            a JavaScript expression.
    S3AwsAuthenticationMethodSecret:
      type: object
      properties:
        awsAuthenticationMethod:
          enum:
            - secret
          type: string
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references AWS access key and
            secret key.
    S3CollectorConf:
      type: object
      title: ""
      required:
        - bucket
      properties:
        outputName:
          type: string
          title: Auto-populate from
          description: Name of the predefined Destination that will be used to
            auto-populate Collector settings
        bucket:
          type: string
          title: S3 bucket
          minLength: 1
          description: S3 Bucket from which to collect data
        parquetChunkSizeMB:
          type: number
          title: Parquet chunk size limit (MB)
          description: Maximum file size for each Parquet chunk
          maximum: 100
          minimum: 1
        parquetChunkDownloadTimeout:
          type: number
          title: Parquet chunk download timeout (seconds)
          description: Maximum time allowed for downloading a Parquet chunk. Processing
            will stop if a chunk cannot be downloaded within the time specified.
          maximum: 3600
          minimum: 1
        region:
          type: string
          title: Region
          description: Region from which to retrieve data
        path:
          type: string
          title: Path
          description: Directory where data will be collected. Templating (such as
            'myDir/${datacenter}/${host}/${app}/') and time-based tokens (such
            as 'myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/') are supported.
            Can be a constant (enclosed in quotes) or a JavaScript expression.
          minLength: 1
        partitioningScheme:
          type: string
          title: Partitioning scheme
          description: Partitioning scheme used for this dataset. Using a known scheme
            like DDSS enables more efficient data reading and retrieval.
          enum:
            - none
            - ddss
          x-speakeasy-enum-descriptions:
            - Defined in Path
            - DDSS
          x-speakeasy-unknown-values: allow
        extractors:
          type: array
          title: Path extractors
          additionalProperties: false
          items:
            type: object
            required:
              - key
              - expression
            properties:
              key:
                type: string
                title: Token
                description: A token from the template path, such as epoch
              expression:
                type: string
                title: Extractor Expression
                description: 'JavaScript expression that receives token under "value" variable,
                  and evaluates to populate event fields. Example: {date: new
                  Date(+value*1000)}'
          description: 'Allows using template tokens as context for expressions that
            enrich discovery results. For example, given a template
            /path/${epoch}, an extractor under key "epoch" with an expression
            {date: new Date(+value*1000)}, will enrich discovery results with a
            human readable "date" field.'
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        endpoint:
          type: string
          title: Endpoint
          description: "Must point to an S3-compatible endpoint. If empty, defaults to an
            AWS region-specific endpoint. "
        enableAssumeRole:
          type: boolean
          title: Enable Assume Role
          description: Use AssumeRole credentials
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the Assumed Role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        maxBatchSize:
          type: number
          title: Batch size limit (objects)
          description: Maximum number of metadata objects to batch before recording as
            results
          minimum: 1
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests to improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA
            (such as a self-signed certificate)
        verifyPermissions:
          type: boolean
          title: Verify bucket permissions
          description: 'Disable if you can access files within the bucket but not the
            bucket itself. Resolves errors of the form "discover task
            initialization failed...error: Forbidden".'
        disableTimeFilter:
          type: boolean
          title: Disable time filter
          description: Disable Collector event time filtering when a date range is specified
        awsApiKey:
          type: string
          title: Access key
          description: Access key. If not present, will fall back to
            env.AWS_ACCESS_KEY_ID, or to the metadata endpoint for IAM creds.
            Optional when running on AWS. This value can be a constant or a
            JavaScript expression.
        awsSecretKey:
          type: string
          title: Secret key
          description: Secret key. If not present, will fall back to
            env.AWS_SECRET_ACCESS_KEY, or to the metadata endpoint for IAM
            creds. Optional when running on AWS. This value can be a constant or
            a JavaScript expression.
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references AWS access key and
            secret key.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/S3PartitioningSchemeDdss"
            - $ref: "#/components/schemas/S3PartitioningSchemeNone"
          discriminator:
            propertyName: partitioningScheme
            mapping:
              ddss: "#/components/schemas/S3PartitioningSchemeDdss"
              none: "#/components/schemas/S3PartitioningSchemeNone"
        - oneOf:
            - $ref: "#/components/schemas/S3AwsAuthenticationMethodAuto"
            - $ref: "#/components/schemas/S3AwsAuthenticationMethodManual"
            - $ref: "#/components/schemas/S3AwsAuthenticationMethodSecret"
          discriminator:
            propertyName: awsAuthenticationMethod
            mapping:
              auto: "#/components/schemas/S3AwsAuthenticationMethodAuto"
              manual: "#/components/schemas/S3AwsAuthenticationMethodManual"
              secret: "#/components/schemas/S3AwsAuthenticationMethodSecret"
    CollectorS3:
      allOf:
        - $ref: "#/components/schemas/CollectorBase"
        - type: object
          properties:
            type:
              type: string
              enum:
                - s3
              description: Collector type
            conf:
              $ref: "#/components/schemas/S3CollectorConf"
      description: S3 collector configuration
    ScriptCollectorConf:
      type: object
      title: ""
      required:
        - discoverScript
        - collectScript
      properties:
        discoverScript:
          type: string
          title: Discover Script
          minLength: 1
          description: Script to discover what to collect. Should output one task per line
            in stdout.
        collectScript:
          type: string
          title: Collect Script
          minLength: 1
          description: Script to run to perform data collections. Task passed in as
            $CRIBL_COLLECT_ARG. Should output results to stdout.
        shell:
          type: string
          title: Shell
          description: Shell to use to execute scripts.
        envVars:
          type: array
          title: Environment Variables
          description: Environment variables to expose to the discover and collect scripts.
          additionalProperties: false
          items:
            type: object
            required:
              - name
              - value
            properties:
              name:
                type: string
                title: Name
                description: Environment variable name
                pattern: ^[a-zA-Z][a-zA-Z0-9_-]*$
              value:
                type: string
                title: Value
                description: JavaScript expression to compute environment variable's value,
                  enclosed in quotes or backticks. (Can evaluate to a constant.)
    CollectorScript:
      allOf:
        - $ref: "#/components/schemas/CollectorBase"
        - type: object
          properties:
            type:
              type: string
              enum:
                - script
              description: Collector type
            conf:
              $ref: "#/components/schemas/ScriptCollectorConf"
      description: Script collector configuration
    SplunkAuthenticationNone:
      type: object
      properties:
        authentication:
          enum:
            - none
          type: string
    SplunkAuthenticationBasic:
      type: object
      properties:
        authentication:
          enum:
            - basic
          type: string
        username:
          type: string
          title: Username
          description: Basic authentication username
        password:
          type: string
          title: Password
          description: Basic authentication password
      required:
        - username
        - password
    SplunkAuthenticationBasicSecret:
      type: object
      properties:
        authentication:
          enum:
            - basicSecret
          type: string
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a stored secret that references your credentials
      required:
        - credentialsSecret
    SplunkAuthenticationToken:
      type: object
      properties:
        authentication:
          enum:
            - token
          type: string
        token:
          type: string
          title: Bearer token
      required:
        - token
    SplunkAuthenticationTokenSecret:
      type: object
      properties:
        authentication:
          enum:
            - tokenSecret
          type: string
        tokenSecret:
          type: string
          title: Bearer token secret
          description: Select or create a stored secret that references your Bearer token
      required:
        - tokenSecret
    SplunkRetryRulesTypeNone:
      type: object
      properties:
        type:
          enum:
            - none
          type: string
    SplunkRetryRulesTypeStatic:
      type: object
      properties:
        type:
          enum:
            - static
          type: string
        interval:
          type: number
          title: Wait (ms)
          description: Time interval between retries. Maximum allowed value is 20,000 ms
            (1/3 minute).
          minimum: 0
          maximum: 20000
        limit:
          type: number
          title: Retry limit
          description: The maximum number of times to retry a failed HTTP request
          minimum: 0
          maximum: 20
        codes:
          type: array
          title: Retry HTTP codes
          description: List of HTTP codes that trigger a retry. Leave empty to use the
            default list of 429 and 503.
          minItems: 1
          items:
            type: number
            minLength: 1
        enableHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) or
            a timestamp after which to retry the request. The delay is limited
            to 20 seconds, even if the Retry-After header specifies a longer
            delay. When disabled, all Retry-After headers are ignored.
        retryConnectTimeout:
          type: boolean
          title: Retry connection timeout
          description: Make a single retry attempt when a connection timeout (ETIMEDOUT)
            error occurs
        retryConnectReset:
          type: boolean
          title: Retry connection reset
          description: Retry request when a connection reset error (ECONNRESET) error occurs
    SplunkRetryRulesTypeBackoff:
      type: object
      properties:
        type:
          enum:
            - backoff
          type: string
        interval:
          type: number
          title: Initial retry interval (ms)
          description: Time interval between failed request and first retry (kickoff).
            Maximum allowed value is 20,000 ms (1/3 minute).
          minimum: 0
          maximum: 20000
        limit:
          type: number
          title: Retry limit
          description: The maximum number of times to retry a failed HTTP request
          minimum: 0
          maximum: 20
        multiplier:
          type: number
          title: Backoff multiplier
          description: Base for exponential backoff. For example, base 2 means that
            retries will occur after 2, then 4, then 8 seconds, and so on.
          minimum: 1
          maximum: 20
        codes:
          type: array
          title: Retry HTTP codes
          description: List of HTTP codes that trigger a retry. Leave empty to use the
            default list of 429 and 503.
          minItems: 1
          items:
            type: number
            minLength: 1
        enableHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) or
            a timestamp after which to retry the request. The delay is limited
            to 20 seconds, even if the Retry-After header specifies a longer
            delay. When disabled, all Retry-After headers are ignored.
        retryConnectTimeout:
          type: boolean
          title: Retry connection timeout
          description: Make a single retry attempt when a connection timeout (ETIMEDOUT)
            error occurs
        retryConnectReset:
          type: boolean
          title: Retry connection reset
          description: Retry request when a connection reset error (ECONNRESET) error occurs
    SplunkCollectorConf:
      type: object
      title: ""
      required:
        - search
        - searchHead
        - endpoint
        - authentication
        - outputMode
      properties:
        searchHead:
          type: string
          title: Search head
          description: Search head base URL. Can be an expression. Default is
            https://localhost:8089.
        search:
          type: string
          title: Search
          description: "Examples: 'index=myAppLogs level=error channel=myApp' OR '| mstats
            avg(myStat) as myStat WHERE index=myStatsIndex.'"
        earliest:
          title: Earliest
          type: string
          description: "The earliest time boundary for the search. Can be an exact or
            relative time. Examples: '2022-01-14T12:00:00Z' or '-16m@m'"
        latest:
          title: Latest
          type: string
          description: "The latest time boundary for the search. Can be an exact or
            relative time. Examples: '2022-01-14T12:00:00Z' or '-1m@m'"
        endpoint:
          type: string
          title: Search endpoint
          description: REST API used to create a search
        outputMode:
          $ref: "#/components/schemas/OutputModeOptionsSplunkCollectorConf"
        collectRequestParams:
          title: Extra parameters
          description: Optional collect request parameters
          type: array
          items:
            type: object
            required:
              - name
              - value
            properties:
              name:
                title: Parameter Name
                type: string
              value:
                title: Value
                type: string
                description: JavaScript expression to compute the parameter's value, normally
                  enclosed in backticks (`${earliest}`). If a constant, use
                  single quotes ('earliest'). Values without delimiters
                  (earliest) are evaluated as strings.
        collectRequestHeaders:
          title: Extra headers
          description: Optional collect request headers
          type: array
          items:
            type: object
            required:
              - name
              - value
            properties:
              name:
                type: string
                title: Header Name
              value:
                type: string
                title: Value
                description: JavaScript expression to compute the header's value, normally
                  enclosed in backticks (`${earliest}`). If a constant, use
                  single quotes ('earliest'). Values without delimiters
                  (earliest) are evaluated as strings.
        authentication:
          type: string
          title: Authentication
          description: Authentication method for Discover and Collect REST calls
          enum:
            - none
            - basic
            - basicSecret
            - token
            - tokenSecret
          x-speakeasy-enum-descriptions:
            - None
            - Basic
            - Basic (credentials secret)
            - Bearer Token
            - Bearer Token (text secret)
          x-speakeasy-unknown-values: allow
        timeout:
          type: number
          title: Request timeout (secs)
          description: HTTP request inactivity timeout. Use 0 for no timeout.
          minimum: 0
          maximum: 1800
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Use round-robin DNS lookup. Suitable when DNS server returns
            multiple addresses in sort order.
        disableTimeFilter:
          type: boolean
          title: Disable time filter
          description: Disable collector event time filtering when a date range is specified
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA
            (such as self-signed certificates)
        handleEscapedChars:
          type: boolean
          title: Preserve escaped characters
          description: Escape characters (\") in search queries will be passed directly to
            Splunk
        retryRules:
          type: object
          required:
            - type
          properties:
            type:
              $ref: "#/components/schemas/RetryTypeOptionsHealthCheckCollectorConfRetryRules"
          allOf:
            - oneOf:
                - $ref: "#/components/schemas/SplunkRetryRulesTypeNone"
                - $ref: "#/components/schemas/SplunkRetryRulesTypeStatic"
                - $ref: "#/components/schemas/SplunkRetryRulesTypeBackoff"
              discriminator:
                propertyName: type
                mapping:
                  none: "#/components/schemas/SplunkRetryRulesTypeNone"
                  static: "#/components/schemas/SplunkRetryRulesTypeStatic"
                  backoff: "#/components/schemas/SplunkRetryRulesTypeBackoff"
        username:
          type: string
          title: Username
          description: Basic authentication username
        password:
          type: string
          title: Password
          description: Basic authentication password
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a stored secret that references your credentials
        token:
          type: string
          title: Bearer token
        tokenSecret:
          type: string
          title: Bearer token secret
          description: Select or create a stored secret that references your Bearer token
        loginUrl:
          type: string
          title: Login URL
          description: URL to use for login API call. This call is expected to be a POST.
        loginBody:
          type: string
          title: POST body
          description: Template for POST body to send with login request. ${username} and
            ${password} are used to specify location of these attributes in the
            message.
        tokenRespAttribute:
          type: string
          title: Token attribute
          description: Path to token attribute in login response body. Nested attributes
            are allowed.
        authHeaderExpr:
          type: string
          title: Authorize Expression
          description: JavaScript expression to compute the Authorization header to pass
            in discover and collect calls. The value ${token} is used to
            reference the token obtained from login.
        __template_searchHead:
          type: string
          description: Binds 'searchHead' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'searchHead' at runtime.
        __template_search:
          type: string
          description: Binds 'search' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'search' at runtime.
        __template_earliest:
          type: string
          description: Binds 'earliest' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'earliest' at runtime.
        __template_latest:
          type: string
          description: Binds 'latest' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'latest' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_outputMode:
          type: string
          description: Binds 'outputMode' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'outputMode' at runtime.
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/SplunkAuthenticationNone"
            - $ref: "#/components/schemas/SplunkAuthenticationBasic"
            - $ref: "#/components/schemas/SplunkAuthenticationBasicSecret"
            - $ref: "#/components/schemas/SplunkAuthenticationToken"
            - $ref: "#/components/schemas/SplunkAuthenticationTokenSecret"
          discriminator:
            propertyName: authentication
            mapping:
              none: "#/components/schemas/SplunkAuthenticationNone"
              basic: "#/components/schemas/SplunkAuthenticationBasic"
              basicSecret: "#/components/schemas/SplunkAuthenticationBasicSecret"
              token: "#/components/schemas/SplunkAuthenticationToken"
              tokenSecret: "#/components/schemas/SplunkAuthenticationTokenSecret"
    CollectorSplunk:
      allOf:
        - $ref: "#/components/schemas/CollectorBase"
        - type: object
          properties:
            type:
              type: string
              enum:
                - splunk
              description: Collector type
            conf:
              $ref: "#/components/schemas/SplunkCollectorConf"
      description: Splunk collector configuration
    Collector:
      description: Collector configuration
      oneOf:
        - $ref: "#/components/schemas/CollectorAzureBlob"
        - $ref: "#/components/schemas/CollectorCriblLake"
        - $ref: "#/components/schemas/CollectorDatabase"
        - $ref: "#/components/schemas/CollectorFilesystem"
        - $ref: "#/components/schemas/CollectorGoogleCloudStorage"
        - $ref: "#/components/schemas/CollectorHealthCheck"
        - $ref: "#/components/schemas/CollectorRest"
        - $ref: "#/components/schemas/CollectorS3"
        - $ref: "#/components/schemas/CollectorScript"
        - $ref: "#/components/schemas/CollectorSplunk"
      discriminator:
        propertyName: type
        mapping:
          azure_blob: "#/components/schemas/CollectorAzureBlob"
          cribl_lake: "#/components/schemas/CollectorCriblLake"
          database: "#/components/schemas/CollectorDatabase"
          filesystem: "#/components/schemas/CollectorFilesystem"
          google_cloud_storage: "#/components/schemas/CollectorGoogleCloudStorage"
          health_check: "#/components/schemas/CollectorHealthCheck"
          rest: "#/components/schemas/CollectorRest"
          s3: "#/components/schemas/CollectorS3"
          script: "#/components/schemas/CollectorScript"
          splunk: "#/components/schemas/CollectorSplunk"
    Connection:
      type: object
      properties:
        output:
          type: string
        pipeline:
          type: string
      required:
        - output
    ProjectConfig:
      type: object
      properties:
        consumers:
          type: object
          additionalProperties:
            type: object
            properties:
              connections:
                type: array
                items:
                  $ref: "#/components/schemas/Connection"
              disabled:
                type: boolean
                description: It should be removed as a consumer is present or absent.
                deprecated: true
              type:
                type: string
        description:
          type: string
        destinations:
          type: array
          items:
            type: string
        id:
          type: string
          description: Unique identifier.
        subscriptions:
          type: array
          items:
            type: string
      required:
        - destinations
        - id
        - subscriptions
    CountedProjectConfig:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ProjectConfig"
    RbacResource:
      type: string
      enum:
        - groups
        - datasets
        - dataset-providers
        - projects
        - dashboards
        - macros
        - notebooks
        - notebook-templates
        - apps
      x-speakeasy-unknown-values: allow
    ResourcePolicy:
      type: object
      properties:
        gid:
          type: string
          description: Unique identifier for the group that owns the resource.
        id:
          type: string
          description: Unique identifier for the resource. Omitted for resource type
            <code>groups</code>.
        policy:
          type: string
          description: String that defines the access control policy for the resource.
        type:
          $ref: "#/components/schemas/RbacResource"
          description: Resource type that the access control policy applies to.
          example: projects
      required:
        - gid
        - policy
        - type
    UserAccessControlList:
      type: object
      properties:
        perms:
          type: array
          items:
            $ref: "#/components/schemas/ResourcePolicy"
        user:
          type: string
      required:
        - perms
        - user
    CountedUserAccessControlList:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/UserAccessControlList"
    AccessControl:
      type: object
      additionalProperties:
        type: array
        items:
          type: string
    AccessControlSchema:
      type: object
      properties:
        add:
          $ref: "#/components/schemas/AccessControl"
        rm:
          $ref: "#/components/schemas/AccessControl"
    CountedProjectDestination:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ProjectDestination"
    ProjectDestination:
      type: object
      properties:
        id:
          type: string
        type:
          type: string
      required:
        - id
        - type
    SubscriptionConsumer:
      type: object
      properties:
        connections:
          type: array
          items:
            $ref: "#/components/schemas/Connection"
        disabled:
          type: boolean
          description: It should be removed as a consumer is present or absent.
          deprecated: true
        type:
          type: string
    Subscription:
      type: object
      properties:
        consumer:
          $ref: "#/components/schemas/SubscriptionConsumer"
          description: Consumers are now defined on projects instead of subscriptions.
          deprecated: true
        description:
          type: string
        disabled:
          type: boolean
        filter:
          type: string
        id:
          type: string
        pipeline:
          type: string
      required:
        - id
        - pipeline
    CountedSubscription:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Subscription"
    CountedDatabaseConnectionConfig:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DatabaseConnectionConfig"
    DatabaseConnectionType:
      type: string
      enum:
        - mysql
        - oracle
        - postgres
        - sqlserver
      x-speakeasy-unknown-values: allow
    DatabaseConnectionConfig:
      type: object
      properties:
        authType:
          type: string
        configObj:
          type: string
        connectionString:
          type: string
        connectionTimeout:
          type: number
        credsSecrets:
          type: string
        databaseType:
          $ref: "#/components/schemas/DatabaseConnectionType"
        description:
          type: string
        id:
          type: string
        password:
          type: string
        requestTimeout:
          type: number
        tags:
          type: string
        textSecret:
          type: string
        user:
          type: string
      required:
        - authType
        - databaseType
        - description
        - id
    CountedDatabaseConnectionTestResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DatabaseConnectionTestResult"
    DatabaseConnectionTestResult:
      type: object
      properties:
        errorMsg:
          type: string
        success:
          type: boolean
      required:
        - success
    DatabaseConnectionTest:
      type: object
      properties:
        authType:
          type: string
        configObj:
          type: string
        connectionString:
          type: string
        connectionTimeout:
          type: number
        credsSecrets:
          type: string
        databaseType:
          type: string
        password:
          type: string
        textSecret:
          type: string
        user:
          type: string
      required:
        - authType
        - databaseType
    EventBreakerRuleset:
      type: object
      additionalProperties: false
      required:
        - id
      properties:
        id:
          type: string
          title: ID
          pattern: ^[a-zA-Z0-9\-_ ]+$
        lib:
          type: string
          title: Library
          enum:
            - custom
            - cribl-custom
          x-speakeasy-unknown-values: allow
        description:
          type: string
          title: Description
        tags:
          type: string
          title: Tags
        minRawLength:
          type: number
          title: Min raw length
          description: The  minimum number of characters in _raw to determine which rule
            to use
          minimum: 50
          maximum: 100000
        rules:
          type: array
          title: Rules
          description: A list of rules that will be applied, in order, to the input data
            stream
          items:
            type: object
            required:
              - name
              - type
              - condition
              - timestampAnchorRegex
              - timestamp
            properties:
              name:
                type: string
                title: Name
              condition:
                type: string
                title: Filter condition
                description: JavaScript expression applied to the beginning of a file or object,
                  to determine whether the rule applies to all contained events.
              type:
                $ref: "#/components/schemas/EventBreakerTypeOptionsEventBreakerExistingOrNewNew"
              timestampAnchorRegex:
                type: string
                title: Timestamp anchor
                description: The regex to match before attempting timestamp extraction. Use $
                  (end-of-string anchor) to prevent extraction.
              timestamp:
                type: object
                required:
                  - type
                title: Timestamp format
                description: Auto, manual format (strptime), or current time
                properties:
                  type:
                    $ref: "#/components/schemas/TimestampTypeOptionsEventBreakerExistingOrNewNewTim\
                      estamp"
                  length:
                    type: number
                    title: Length
                    minimum: 2
                  format:
                    type: string
                    title: Format
              timestampTimezone:
                type: string
                title: Default timezone
                description: Timezone to assign to timestamps without timezone info
              timestampEarliest:
                title: Earliest timestamp allowed
                description: "The earliest timestamp value allowed relative to now. Example:
                  -42years. Parsed values prior to this date will be set to
                  current time."
                type: string
              timestampLatest:
                title: Future timestamp allowed
                description: "The latest timestamp value allowed relative to now. Example:
                  +42days. Parsed values after this date will be set to current
                  time."
                type: string
              maxEventBytes:
                type: number
                title: Event byte limit
                description: The maximum number of bytes in an event before it is flushed to the
                  pipelines
                minimum: 1
                maximum: 134217728
              fields:
                title: Fields
                description: Key-value pairs to be added to each event
                type: array
                items:
                  type: object
                  required:
                    - value
                  properties:
                    name:
                      type: string
                      title: Name
                    value:
                      type: string
                      title: Value expression
                      description: The JavaScript expression used to compute the field's value (can be
                        constant)
              disabled:
                title: Disabled
                type: boolean
                description: Disable this breaker rule (enabled by default)
              parserEnabled:
                title: Parser
                type: boolean
              shouldUseDataRaw:
                title: Data _raw
                type: boolean
                description: Enable to set an internal field on events indicating that the field
                  in the data called _raw should be used. This can be useful for
                  post processors that want to use that field for event._raw,
                  instead of replacing it with the actual raw event.
              __template_timestampTimezone:
                type: string
                description: Binds 'timestampTimezone' to a variable for dynamic value
                  resolution. Set to variable ID (pack-scoped) or
                  'cribl.'/'edge.' prefixed ID (group-scoped). Variable value
                  overrides 'timestampTimezone' at runtime.
    CountedEventBreakerRuleset:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/EventBreakerRuleset"
    ContextMoveRequestBody:
      type: object
      properties:
        context:
          oneOf:
            - type: "null"
            - type: object
              properties:
                id:
                  type: string
                  description: Identifier for the destination Pack.
                type:
                  type: string
                  const: pack
                  description: Must be <code>pack</code>.
              required:
                - id
                - type
          description: Destination context. Provide a Pack context to move the resource
            into a Pack, or pass <code>null</code> to move the resource to the
            global context.
      required:
        - context
    CountedFunctionResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/FunctionResponse"
    CollectorScope:
      type: string
      const: pack
    CountedCollector:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Collector"
    Function:
      type: object
      properties:
        __conf:
          type: object
          additionalProperties: true
        __filename:
          type: string
        disabled:
          type: boolean
        group:
          type: string
        id:
          type: string
        initTime:
          type: number
        loadTime:
          type: number
        modTime:
          type: number
        name:
          type: string
        uischema:
          type: object
          additionalProperties: true
        version:
          type: string
      required:
        - __conf
        - __filename
        - group
        - id
        - initTime
        - loadTime
        - modTime
        - name
        - uischema
        - version
    Executor:
      $ref: "#/components/schemas/Function"
    CountedExecutor:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Executor"
    GlobalVar:
      type: object
      required:
        - id
        - type
      properties:
        id:
          type: string
          title: Name
          pattern: ^[a-zA-Z0-9_-]+$
          description: Global variable name
        lib:
          type: string
          title: Library
        description:
          type: string
          title: Description
        type:
          type: string
          title: Type
          enum:
            - string
            - number
            - encryptedString
            - boolean
            - array
            - object
            - expression
            - any
          x-speakeasy-enum-descriptions:
            - string
            - number
            - encrypted string
            - boolean
            - array
            - object
            - expression
            - any
          x-speakeasy-unknown-values: allow
        value:
          type: string
          title: Value
        tags:
          type: string
          title: Tags
    CountedGlobalVar:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GlobalVar"
    CriblLib:
      type: string
      enum:
        - cribl
        - cribl-custom
        - custom
      x-speakeasy-unknown-values: allow
    HmacFunction:
      type: object
      properties:
        description:
          type: string
        headerExpression:
          type: string
        headerName:
          type: string
        id:
          type: string
        lib:
          $ref: "#/components/schemas/CriblLib"
        stringBuilders:
          type: array
          items:
            type: string
        stringDelim:
          type: string
      required:
        - headerExpression
        - headerName
        - id
        - lib
        - stringBuilders
    CountedHmacFunction:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/HmacFunction"
    InputCollection:
      type: object
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - collection
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process results
        sendToRoutes:
          type: boolean
          title: Send to Routes
          description: Send events to normal routing and event processing. Disable to
            select a specific Pipeline/Destination combination.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        preprocess:
          $ref: "#/components/schemas/PreprocessType"
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        output:
          type: string
          title: Destination
          description: Destination to send results to
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    InputKafka:
      type: object
      required:
        - type
        - brokers
        - topics
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - kafka
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        brokers:
          type: array
          title: Bootstrap servers
          description: Enter each Kafka bootstrap server you want to use. Specify the
            hostname and port (such as mykafkabroker:9092) or just the hostname
            (in which case @{product} will assign port 9092).
          minItems: 1
          items:
            type: string
            minLength: 1
        topics:
          type: array
          title: Topic
          description: "Topic to subscribe to. Warning: To optimize performance, Cribl
            suggests subscribing each Kafka Source to a single topic only."
          minItems: 1
          items:
            type: string
            minLength: 1
        groupId:
          type: string
          title: Group ID
          description: The consumer group to which this instance belongs. Defaults to
            'Cribl'.
        fromBeginning:
          type: boolean
          title: From beginning
          description: Leave enabled if you want the Source, upon first subscribing to a
            topic, to read starting with the earliest available message
        kafkaSchemaRegistry:
          $ref: "#/components/schemas/KafkaSchemaRegistryAuthenticationType"
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a connection to complete successfully
          minimum: 1000
          maximum: 3600000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for Kafka to respond to a request
          minimum: 1000
          maximum: 3600000
        maxRetries:
          type: number
          title: Retry limit
          description: If messages are failing, you can set the maximum number of retries
            as high as 100 to prevent loss of data
          minimum: 0
          maximum: 100
        maxBackOff:
          type: number
          title: Backoff limit (ms)
          description: The maximum wait time for a retry, in milliseconds. Default (and
            minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180
            seconds).
          minimum: 30000
          maximum: 180000
        initialBackoff:
          type: number
          title: Initial retry interval (ms)
          description: Initial value used to calculate the retry, in milliseconds. Maximum
            is 600,000 ms (10 minutes).
          minimum: 300
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Set the backoff multiplier (2-20) to control the retry frequency
            for failed messages. For faster retries, use a lower multiplier. For
            slower retries with more delay between attempts, use a higher
            multiplier. The multiplier is used in an exponential backoff
            formula; see the Kafka
            [documentation](https://kafka.js.org/docs/retry-detailed) for
            details.
          minimum: 2
          maximum: 20
        authenticationTimeout:
          type: number
          title: Authentication timeout (ms)
          description: Maximum time to wait for Kafka to respond to an authentication
            request
          minimum: 1000
          maximum: 3600000
        reauthenticationThreshold:
          type: number
          title: Reauthentication threshold (ms)
          description: Specifies a time window during which @{product} can reauthenticate
            if needed. Creates the window measuring backward from the moment
            when credentials are set to expire.
          minimum: 1000
          maximum: 1800000
        sasl:
          $ref: "#/components/schemas/AuthenticationType"
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        sessionTimeout:
          type: number
          title: Session timeout (ms)
          description: >2-
            
                  Timeout used to detect client failures when using Kafka's group-management facilities.
                  If the client sends no heartbeats to the broker before the timeout expires, 
                  the broker will remove the client from the group and initiate a rebalance.
                  Value must be between the broker's configured group.min.session.timeout.ms and group.max.session.timeout.ms.
                  See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_session.timeout.ms) for details.
          minimum: 1000
          maximum: 3600000
        rebalanceTimeout:
          type: number
          title: Rebalance timeout (ms)
          description: >2-
            
                  Maximum allowed time for each worker to join the group after a rebalance begins.
                  If the timeout is exceeded, the coordinator broker will remove the worker from the group.
                  See [Kafka's documentation](https://kafka.apache.org/documentation/#connectconfigs_rebalance.timeout.ms) for details.
          minimum: 1000
          maximum: 3600000
        heartbeatInterval:
          type: number
          title: Heartbeat interval (ms)
          description: >2-
            
                  Expected time between heartbeats to the consumer coordinator when using Kafka's group-management facilities.
                  Value must be lower than sessionTimeout and typically should not exceed 1/3 of the sessionTimeout value.
                  See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_heartbeat.interval.ms) for details.
          minimum: 1000
          maximum: 3600000
        autoCommitInterval:
          type: number
          title: Offset commit interval (ms)
          description: How often to commit offsets. If both this and Offset commit
            threshold are set, @{product} commits offsets when either condition
            is met. If both are empty, @{product} commits offsets after each
            batch.
          minimum: 1000
          maximum: 3600000
        autoCommitThreshold:
          type: number
          title: Offset commit threshold
          description: How many events are needed to trigger an offset commit. If both
            this and Offset commit interval are set, @{product} commits offsets
            when either condition is met. If both are empty, @{product} commits
            offsets after each batch.
          minimum: 1
          maximum: 10000
        maxBytesPerPartition:
          type: number
          title: Byte limit, per partition
          description: Maximum amount of data that Kafka will return per partition, per
            fetch request. Must equal or exceed the maximum message size
            (maxBytesPerPartition) that Kafka is configured to allow. Otherwise,
            @{product} can get stuck trying to retrieve messages. Defaults to
            1048576 (1 MB).
          minimum: 1
          maximum: 10000000
        maxBytes:
          type: number
          title: Byte limit
          description: Maximum number of bytes that Kafka will return per fetch request.
            Defaults to 10485760 (10 MB).
          minimum: 1
          maximum: 1000000000
        maxSocketErrors:
          type: number
          title: Error limit, per socket
          description: Maximum number of network errors before the consumer re-creates a
            socket
          minimum: 0
          maximum: 100
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_brokers:
          type: string
          description: Binds 'brokers' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'brokers' at runtime.
        __template_topics:
          type: string
          description: Binds 'topics' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topics' at runtime.
        __template_groupId:
          type: string
          description: Binds 'groupId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'groupId' at runtime.
    InputMsk:
      type: object
      required:
        - type
        - brokers
        - topics
        - region
        - awsAuthenticationMethod
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - msk
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        brokers:
          type: array
          title: Bootstrap servers
          description: Enter each Kafka bootstrap server you want to use. Specify the
            hostname and port (such as mykafkabroker:9092) or just the hostname
            (in which case @{product} will assign port 9092).
          minItems: 1
          items:
            type: string
            minLength: 1
        topics:
          type: array
          title: Topic
          description: "Topic to subscribe to. Warning: To optimize performance, Cribl
            suggests subscribing each Kafka Source to a single topic only."
          minItems: 1
          items:
            type: string
            minLength: 1
        groupId:
          type: string
          title: Group ID
          description: The consumer group to which this instance belongs. Defaults to
            'Cribl'.
        fromBeginning:
          type: boolean
          title: From beginning
          description: Leave enabled if you want the Source, upon first subscribing to a
            topic, to read starting with the earliest available message
        sessionTimeout:
          type: number
          title: Session timeout (ms)
          description: >2-
            
                  Timeout used to detect client failures when using Kafka's group-management facilities.
                  If the client sends no heartbeats to the broker before the timeout expires, 
                  the broker will remove the client from the group and initiate a rebalance.
                  Value must be between the broker's configured group.min.session.timeout.ms and group.max.session.timeout.ms.
                  See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_session.timeout.ms) for details.
          minimum: 1000
          maximum: 3600000
        rebalanceTimeout:
          type: number
          title: Rebalance timeout (ms)
          description: >2-
            
                  Maximum allowed time for each worker to join the group after a rebalance begins.
                  If the timeout is exceeded, the coordinator broker will remove the worker from the group.
                  See [Kafka's documentation](https://kafka.apache.org/documentation/#connectconfigs_rebalance.timeout.ms) for details.
          minimum: 1000
          maximum: 3600000
        heartbeatInterval:
          type: number
          title: Heartbeat interval (ms)
          description: >2-
            
                  Expected time between heartbeats to the consumer coordinator when using Kafka's group-management facilities.
                  Value must be lower than sessionTimeout and typically should not exceed 1/3 of the sessionTimeout value.
                  See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_heartbeat.interval.ms) for details.
          minimum: 1000
          maximum: 3600000
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        kafkaSchemaRegistry:
          $ref: "#/components/schemas/KafkaSchemaRegistryAuthenticationType"
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a connection to complete successfully
          minimum: 1000
          maximum: 3600000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for Kafka to respond to a request
          minimum: 1000
          maximum: 3600000
        maxRetries:
          type: number
          title: Retry limit
          description: If messages are failing, you can set the maximum number of retries
            as high as 100 to prevent loss of data
          minimum: 0
          maximum: 100
        maxBackOff:
          type: number
          title: Backoff limit (ms)
          description: The maximum wait time for a retry, in milliseconds. Default (and
            minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180
            seconds).
          minimum: 30000
          maximum: 180000
        initialBackoff:
          type: number
          title: Initial retry interval (ms)
          description: Initial value used to calculate the retry, in milliseconds. Maximum
            is 600,000 ms (10 minutes).
          minimum: 300
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Set the backoff multiplier (2-20) to control the retry frequency
            for failed messages. For faster retries, use a lower multiplier. For
            slower retries with more delay between attempts, use a higher
            multiplier. The multiplier is used in an exponential backoff
            formula; see the Kafka
            [documentation](https://kafka.js.org/docs/retry-detailed) for
            details.
          minimum: 2
          maximum: 20
        authenticationTimeout:
          type: number
          title: Authentication timeout (ms)
          description: Maximum time to wait for Kafka to respond to an authentication
            request
          minimum: 1000
          maximum: 3600000
        reauthenticationThreshold:
          type: number
          title: Reauthentication threshold (ms)
          description: Specifies a time window during which @{product} can reauthenticate
            if needed. Creates the window measuring backward from the moment
            when credentials are set to expire.
          minimum: 1000
          maximum: 1800000
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: Region where the MSK cluster is located
        endpoint:
          type: string
          title: Endpoint
          description: MSK cluster service endpoint. If empty, defaults to the AWS
            Region-specific endpoint. Otherwise, it must point to MSK
            cluster-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        enableAssumeRole:
          type: boolean
          title: Enable for MSK
          description: Use Assume Role credentials to access MSK
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        autoCommitInterval:
          type: number
          title: Offset commit interval (ms)
          description: How often to commit offsets. If both this and Offset commit
            threshold are set, @{product} commits offsets when either condition
            is met. If both are empty, @{product} commits offsets after each
            batch.
          minimum: 1000
          maximum: 3600000
        autoCommitThreshold:
          type: number
          title: Offset commit threshold
          description: How many events are needed to trigger an offset commit. If both
            this and Offset commit interval are set, @{product} commits offsets
            when either condition is met. If both are empty, @{product} commits
            offsets after each batch.
          minimum: 1
          maximum: 10000
        maxBytesPerPartition:
          type: number
          title: Byte limit, per partition
          description: Maximum amount of data that Kafka will return per partition, per
            fetch request. Must equal or exceed the maximum message size
            (maxBytesPerPartition) that Kafka is configured to allow. Otherwise,
            @{product} can get stuck trying to retrieve messages. Defaults to
            1048576 (1 MB).
          minimum: 1
          maximum: 10000000
        maxBytes:
          type: number
          title: Byte limit
          description: Maximum number of bytes that Kafka will return per fetch request.
            Defaults to 10485760 (10 MB).
          minimum: 1
          maximum: 1000000000
        maxSocketErrors:
          type: number
          title: Error limit, per socket
          description: Maximum number of network errors before the consumer re-creates a
            socket
          minimum: 0
          maximum: 100
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_brokers:
          type: string
          description: Binds 'brokers' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'brokers' at runtime.
        __template_topics:
          type: string
          description: Binds 'topics' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topics' at runtime.
        __template_groupId:
          type: string
          description: Binds 'groupId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'groupId' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    InputHttp:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - http
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        authTokens:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            type: string
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        criblAPI:
          type: string
          title: Cribl HTTP event API
          description: Absolute path on which to listen for the Cribl HTTP API requests.
            Only _bulk (default /cribl/_bulk) is available. Use empty string to
            disable.
          pattern: ^/|^$
        elasticAPI:
          type: string
          title: Elasticsearch API endpoint (Bulk API)
          description: Absolute path on which to listen for the Elasticsearch API
            requests. Only _bulk (default /elastic/_bulk) is available. Use
            empty string to disable.
          pattern: ^/|^$
        splunkHecAPI:
          type: string
          title: Splunk HEC endpoint
          description: Absolute path on which listen for the Splunk HTTP Event Collector
            API requests. Use empty string to disable.
          pattern: ^/|^$
        splunkHecAcks:
          type: boolean
          title: Enable Splunk HEC acknowledgements
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        authTokensExt:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            $ref: "#/components/schemas/AuthTokensExtConfInputHttp"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_authTokens:
          type: string
          description: Binds 'authTokens' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'authTokens' at runtime.
        __template_criblAPI:
          type: string
          description: Binds 'criblAPI' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'criblAPI' at runtime.
        __template_elasticAPI:
          type: string
          description: Binds 'elasticAPI' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'elasticAPI' at runtime.
        __template_splunkHecAPI:
          type: string
          description: Binds 'splunkHecAPI' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'splunkHecAPI' at runtime.
    InputSplunk:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - splunk
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        ipWhitelistRegex:
          type: string
          title: IP allowlist regex
          description: Regex matching IP addresses that are allowed to establish a
            connection
        maxActiveCxn:
          type: number
          title: Active connection limit
          description: Maximum number of active connections allowed per Worker Process.
            Use 0 for unlimited.
          minimum: 0
        socketIdleTimeout:
          type: number
          title: Socket idle timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. After this time, the connection will be
            closed. Leave at 0 for no inactive socket monitoring.
          minimum: 0
        socketEndingMaxWait:
          type: number
          title: Forced socket termination timeout (seconds)
          description: How long the server will wait after initiating a closure for a
            client to close its end of the connection. If the client doesn't
            close the connection within this time, the server will forcefully
            terminate the socket to prevent resource leaks and ensure efficient
            connection cleanup and system stability. Leave at 0 for no inactive
            socket monitoring.
          minimum: 0
        socketMaxLifespan:
          type: number
          title: Socket max lifespan (seconds)
          description: The maximum duration a socket can remain open, even if active. This
            helps manage resources and mitigate issues caused by TCP pinning.
            Set to 0 to disable.
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Enable proxy protocol
          description: Enable if the connection is proxied by a device that supports proxy
            protocol v1 or v2
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        authTokens:
          type: array
          title: Auth tokens
          description: Shared secrets to be provided by any Splunk forwarder. If empty,
            unauthorized access is permitted.
          items:
            type: object
            required:
              - token
            properties:
              token:
                type: string
                title: Token
                description: Shared secrets to be provided by any Splunk forwarder. If empty,
                  unauthorized access is permitted.
              description:
                type: string
                title: Description
        maxS2Sversion:
          type: string
          title: Max S2S version
          description: The highest S2S protocol version to advertise during handshake
          enum:
            - v3
            - v4
          x-speakeasy-enum-descriptions:
            - v3
            - v4
          x-speakeasy-unknown-values: allow
        description:
          type: string
          title: Description
        useFwdTimezone:
          type: boolean
          title: Use Universal Forwarder time zone
          description: Event Breakers will determine events' time zone from UF-provided
            metadata, when TZ can't be inferred from the raw event
        dropControlFields:
          type: boolean
          title: Drop control fields
          description: Drop Splunk control fields such as `crcSalt` and `_savedPort`. If
            disabled, control fields are stored in the internal field
            `__ctrlFields`.
        extractMetrics:
          type: boolean
          title: Extract metrics
          description: Extract and process Splunk-generated metrics as Cribl metrics
        compress:
          type: string
          title: Compression
          description: Controls whether to support reading compressed data from a
            forwarder. Select 'Automatic' to match the forwarder's
            configuration, or 'Disabled' to reject compressed connections.
          enum:
            - disabled
            - auto
            - always
          x-speakeasy-enum-descriptions:
            - Disabled
            - Automatic
            - Always
          x-speakeasy-unknown-values: allow
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_maxS2Sversion:
          type: string
          description: Binds 'maxS2Sversion' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'maxS2Sversion' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
    InputSplunkSearch:
      type: object
      required:
        - type
        - authType
        - searchHead
        - search
        - cronSchedule
        - endpoint
        - outputMode
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - splunk_search
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        searchHead:
          title: Search head
          type: string
          description: Search head base URL. Can be an expression. Default is
            https://localhost:8089.
        search:
          type: string
          title: Search
          description: "Enter Splunk search here. Examples: 'index=myAppLogs level=error
            channel=myApp' OR '| mstats avg(myStat) as myStat WHERE
            index=myStatsIndex.'"
        earliest:
          title: Earliest
          type: string
          description: "The earliest time boundary for the search. Can be an exact or
            relative time. Examples: '2022-01-14T12:00:00Z' or '-16m@m'"
        latest:
          title: Latest
          type: string
          description: "The latest time boundary for the search. Can be an exact or
            relative time. Examples: '2022-01-14T12:00:00Z' or '-1m@m'"
        cronSchedule:
          type: string
          title: Cron schedule
          description: A cron schedule on which to run this job
        endpoint:
          type: string
          title: Search endpoint
          description: REST API used to create a search
        outputMode:
          $ref: "#/components/schemas/OutputModeOptionsSplunkCollectorConf"
        endpointParams:
          title: Endpoint parameters
          type: array
          description: Optional request parameters to send to the endpoint
          items:
            type: object
            required:
              - name
              - value
            properties:
              name:
                title: Parameter Name
                type: string
              value:
                title: Value
                type: string
                description: JavaScript expression to compute the parameter's value, normally
                  enclosed in backticks (e.g., `${earliest}`). If a constant,
                  use single quotes (e.g., 'earliest'). Values without
                  delimiters (e.g., earliest) are evaluated as strings.
        endpointHeaders:
          title: Endpoint headers
          description: Optional request headers to send to the endpoint
          type: array
          items:
            type: object
            required:
              - name
              - value
            properties:
              name:
                type: string
                title: Header Name
              value:
                type: string
                title: Value
                description: JavaScript expression to compute the header's value, normally
                  enclosed in backticks (e.g., `${earliest}`). If a constant,
                  use single quotes (e.g., 'earliest'). Values without
                  delimiters (e.g., earliest) are evaluated as strings.
        logLevel:
          type: string
          title: Log level
          enum:
            - error
            - warn
            - info
            - debug
          description: Collector runtime log level (verbosity)
          x-speakeasy-unknown-values: allow
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout. Use 0 for no timeout.
          minimum: 0
          maximum: 2400
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: When a DNS server returns multiple addresses, @{product} will cycle
            through them in the order returned
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA
            (such as self-signed certificates)
        encoding:
          type: string
          title: Encoding
          description: Character encoding to use when parsing ingested data. When not set,
            @{product} will default to UTF-8 but may incorrectly interpret
            multi-byte characters.
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        jobTimeout:
          type: string
          title: Job timeout
          description: Maximum time the job is allowed to run (e.g., 30, 45s or 15m).
            Units are seconds, if not specified. Enter 0 for unlimited time.
          pattern: ^\d+[sm]?$
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        retryRules:
          $ref: "#/components/schemas/RetryRulesType"
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        authType:
          type: string
          title: Authentication type
          description: Splunk Search authentication type
          enum:
            - none
            - basic
            - credentialsSecret
            - token
            - textSecret
          x-speakeasy-enum-descriptions:
            - None
            - Basic
            - Basic (credentials secret)
            - Token
            - Token (text secret)
          x-speakeasy-unknown-values: allow
        description:
          type: string
          title: Description
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        token:
          type: string
          title: Token
          description: Bearer token to include in the authorization header
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        textSecret:
          type: string
          title: Token (text secret)
          description: Select or create a stored text secret
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_searchHead:
          type: string
          description: Binds 'searchHead' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'searchHead' at runtime.
        __template_search:
          type: string
          description: Binds 'search' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'search' at runtime.
        __template_earliest:
          type: string
          description: Binds 'earliest' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'earliest' at runtime.
        __template_latest:
          type: string
          description: Binds 'latest' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'latest' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_logLevel:
          type: string
          description: Binds 'logLevel' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'logLevel' at runtime.
    InputSplunkHec:
      type: object
      required:
        - type
        - host
        - port
        - splunkHecAPI
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - splunk_hec
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        authTokens:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            type: object
            required:
              - token
            properties:
              authType:
                $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
              tokenSecret:
                type: string
                title: Token secret (text secret)
                description: Select or create a stored text secret
              token:
                type: string
                title: Token
                description: "Shared secret to be provided by any client (Authorization:
                  <token>)"
              enabled:
                type: boolean
                title: Enable token
              description:
                type: string
                title: Description
                description: Optional token description
              allowedIndexesAtToken:
                type: array
                title: Allowed indexes
                description: Enter the values you want to allow in the HEC event index field at
                  the token level. Supports wildcards. To skip validation, leave
                  blank.
                minItems: 0
                items:
                  type: string
                  minLength: 1
              metadata:
                type: array
                title: Fields
                description: Fields to add to events referencing this token
                items:
                  $ref: "#/components/schemas/MetadataConfInputCollection"
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        splunkHecAPI:
          type: string
          title: Splunk HEC endpoint
          description: Absolute path on which to listen for the Splunk HTTP Event
            Collector API requests. This input supports the /event, /raw and
            /s2s endpoints.
          pattern: ^/
        metadata:
          type: array
          title: Fields
          description: Fields to add to every event. Overrides fields added at the token
            or request level. See [the Source
            documentation](https://docs.cribl.io/stream/sources-splunk-hec/#fields)
            for more info.
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        allowedIndexes:
          type: array
          title: Allowed indexes
          description: List values allowed in HEC event index field. Leave blank to skip
            validation. Supports wildcards. The values here can expand index
            validation at the token level.
          minItems: 0
          items:
            type: string
            minLength: 1
        splunkHecAcks:
          type: boolean
          title: Splunk HEC acks
          description: Enable Splunk HEC acknowledgements
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        useFwdTimezone:
          type: boolean
          title: Use Universal Forwarder time zone (S2S only)
          description: Event Breakers will determine events' time zone from UF-provided
            metadata, when TZ can't be inferred from the raw event
        dropControlFields:
          type: boolean
          title: Drop control fields (S2S only)
          description: Drop Splunk control fields such as `crcSalt` and `_savedPort`. If
            disabled, control fields are stored in the internal field
            `__ctrlFields`.
        extractMetrics:
          type: boolean
          title: Extract metrics (S2S only)
          description: Extract and process Splunk-generated metrics as Cribl metrics
        accessControlAllowOrigin:
          title: CORS allowed origins
          type: array
          description: Optionally, list HTTP origins to which @{product} should send CORS
            (cross-origin resource sharing) Access-Control-Allow-* headers.
            Supports wildcards.
          minItems: 0
          items:
            type: string
            minLength: 1
        accessControlAllowHeaders:
          title: CORS allowed headers
          type: array
          description: Optionally, list HTTP headers that @{product} will send to allowed
            origins as "Access-Control-Allow-Headers" in a CORS preflight
            response. Use "*" to allow all headers.
          minItems: 0
          items:
            type: string
            minLength: 1
        emitTokenMetrics:
          type: boolean
          title: Emit per-token request metrics
          description: Emit per-token (<prefix>.http.perToken) and summary
            (<prefix>.http.summary) request metrics
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_splunkHecAPI:
          type: string
          description: Binds 'splunkHecAPI' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'splunkHecAPI' at runtime.
    InputAzureBlob:
      type: object
      required:
        - type
        - queueName
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - azure_blob
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        queueName:
          type: string
          title: Queue
          description: "The storage account queue name blob notifications will be read
            from. Value must be a JavaScript expression (which can evaluate to a
            constant value), enclosed in quotes or backticks. Can be evaluated
            only at initialization time. Example referencing a Global Variable:
            `myQueue-${C.vars.myVar}`"
        fileFilter:
          type: string
          title: Filename filter
          description: "Regex matching file names to download and process. Defaults to: .*"
        visibilityTimeout:
          type: number
          title: Visibility timeout (secs)
          description: The duration (in seconds) that the received messages are hidden
            from subsequent retrieve requests after being retrieved by a
            ReceiveMessage request.
          minimum: 0
          maximum: 604800
        numReceivers:
          type: number
          title: Number of receivers
          description: How many receiver processes to run. The higher the number, the
            better the throughput - at the expense of CPU overhead.
          minimum: 1
          maximum: 100
        maxMessages:
          type: number
          title: Message limit
          description: "The maximum number of messages to return in a poll request. Azure
            storage queues never returns more messages than this value (however,
            fewer messages might be returned). Valid values: 1 to 32."
          minimum: 1
          maximum: 32
        servicePeriodSecs:
          type: number
          title: Service period (secs)
          description: The duration (in seconds) which pollers should be validated and
            restarted if exited
          minimum: 1
          maximum: 10
        skipOnError:
          type: boolean
          title: Skip file on error
          description: Skip files that trigger a processing error. Disabled by default,
            which allows retries after processing errors.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        parquetChunkSizeMB:
          type: number
          title: Parquet chunk size limit (MB)
          description: Maximum file size for each Parquet chunk
          maximum: 100
          minimum: 1
        parquetChunkDownloadTimeout:
          type: number
          title: Parquet chunk download timeout (seconds)
          description: The maximum time allowed for downloading a Parquet chunk.
            Processing will stop if a chunk cannot be downloaded within the time
            specified.
          maximum: 3600
          minimum: 1
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptions"
        description:
          type: string
          title: Description
        connectionString:
          type: string
          title: Connection string
          description: Enter your Azure Storage account connection string. If left blank,
            Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING.
        textSecret:
          type: string
          title: Connection string (text secret)
          description: Select or create a stored text secret
        storageAccountName:
          type: string
          title: Storage account name
          description: The name of your Azure storage account
        tenantId:
          type: string
          title: Tenant ID
          description: The service principal's tenant ID
        clientId:
          type: string
          title: Client ID
          description: The service principal's client ID
        azureCloud:
          type: string
          title: Azure Cloud
          description: The Azure cloud to use. Defaults to Azure Public Cloud.
        endpointSuffix:
          type: string
          title: Endpoint suffix
          description: Endpoint suffix for the service URL. Takes precedence over the
            Azure Cloud setting. Defaults to core.windows.net.
        clientTextSecret:
          type: string
          title: Client secret (text secret)
          description: Select or create a stored text secret
        certificate:
          $ref: "#/components/schemas/CertificateTypeAzureBlobAuthTypeClientCert"
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_queueName:
          type: string
          description: Binds 'queueName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'queueName' at runtime.
        __template_connectionString:
          type: string
          description: Binds 'connectionString' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'connectionString' at runtime.
        __template_storageAccountName:
          type: string
          description: Binds 'storageAccountName' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'storageAccountName' at runtime.
        __template_tenantId:
          type: string
          description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tenantId' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
        __template_azureCloud:
          type: string
          description: Binds 'azureCloud' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'azureCloud' at runtime.
    InputElastic:
      type: object
      required:
        - type
        - host
        - port
        - elasticAPI
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - elastic
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        elasticAPI:
          type: string
          title: Elasticsearch API endpoint
          description: Absolute path on which to listen for Elasticsearch API requests.
            Defaults to /. _bulk will be appended automatically. For example,
            /myPath becomes /myPath/_bulk. Requests can then be made to either
            /myPath/_bulk or /myPath/<myIndexName>/_bulk. Other entries are
            faked as success.
          pattern: ^/
        authType:
          type: string
          title: Authentication type
          enum:
            - none
            - basic
            - credentialsSecret
            - authTokens
          x-speakeasy-enum-descriptions:
            - None
            - Basic
            - Basic (credentials secret)
            - Auth Tokens
          x-speakeasy-unknown-values: allow
        apiVersion:
          type: string
          title: API version
          description: The API version to use for communicating with the server
          enum:
            - 6.8.4
            - 8.3.2
            - custom
          x-speakeasy-enum-descriptions:
            - 6.8.4
            - 8.3.2
            - Custom
          x-speakeasy-unknown-values: allow
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        proxyMode:
          type: object
          title: ""
          required:
            - enabled
          properties:
            enabled:
              type: boolean
              title: Enable proxy mode
              description: Enable proxying of non-bulk API requests to an external Elastic
                server. Enable this only if you understand the implications. See
                [Cribl
                Docs](https://docs.cribl.io/stream/sources-elastic/#proxy-mode)
                for more details.
            authType:
              enum:
                - none
                - manual
                - secret
              title: Authentication method
              type: string
              description: Enter credentials directly, or select a stored secret
              x-speakeasy-unknown-values: allow
            username:
              type: string
              title: Username
            password:
              type: string
              title: Password
            credentialsSecret:
              type: string
              title: Credentials secret
              description: Select or create a secret that references your credentials
            url:
              type: string
              title: Proxy URL
              description: URL of the Elastic server to proxy non-bulk requests to, such as
                http://elastic:9200
            rejectUnauthorized:
              type: boolean
              title: Reject unauthorized certificates
              description: Reject certificates that cannot be verified against a valid CA
                (such as self-signed certificates)
            removeHeaders:
              type: array
              title: Remove headers
              description: List of headers to remove from the request to proxy
              minItems: 0
              items:
                type: string
                minLength: 1
            timeoutSec:
              type: number
              minimum: 1
              maximum: 9007199254740991
              title: Proxy request timeout
              description: Amount of time, in seconds, to wait for a proxy request to complete
                before canceling it
            __template_url:
              type: string
              description: Binds 'url' to a variable for dynamic value resolution. Set to
                variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'url' at runtime.
        description:
          type: string
          title: Description
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        authTokens:
          type: array
          title: Token
          description: Bearer tokens to include in the authorization header
          items:
            type: string
        customAPIVersion:
          type: string
          title: Custom API Version
          description: Custom version information to respond to requests
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_elasticAPI:
          type: string
          description: Binds 'elasticAPI' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'elasticAPI' at runtime.
        __template_authTokens:
          type: string
          description: Binds 'authTokens' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'authTokens' at runtime.
    InputConfluentCloud:
      type: object
      required:
        - type
        - brokers
        - topics
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - confluent_cloud
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        brokers:
          type: array
          title: Bootstrap servers
          description: List of Confluent Cloud bootstrap servers to use, such as
            yourAccount.confluent.cloud:9092
          minItems: 1
          items:
            type: string
            minLength: 1
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        topics:
          type: array
          title: Topic
          description: "Topic to subscribe to. Warning: To optimize performance, Cribl
            suggests subscribing each Kafka Source to a single topic only."
          minItems: 1
          items:
            type: string
            minLength: 1
        groupId:
          type: string
          title: Group ID
          description: The consumer group to which this instance belongs. Defaults to
            'Cribl'.
        fromBeginning:
          type: boolean
          title: From beginning
          description: Leave enabled if you want the Source, upon first subscribing to a
            topic, to read starting with the earliest available message
        kafkaSchemaRegistry:
          $ref: "#/components/schemas/KafkaSchemaRegistryAuthenticationType"
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a connection to complete successfully
          minimum: 1000
          maximum: 3600000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for Kafka to respond to a request
          minimum: 1000
          maximum: 3600000
        maxRetries:
          type: number
          title: Retry limit
          description: If messages are failing, you can set the maximum number of retries
            as high as 100 to prevent loss of data
          minimum: 0
          maximum: 100
        maxBackOff:
          type: number
          title: Backoff limit (ms)
          description: The maximum wait time for a retry, in milliseconds. Default (and
            minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180
            seconds).
          minimum: 30000
          maximum: 180000
        initialBackoff:
          type: number
          title: Initial retry interval (ms)
          description: Initial value used to calculate the retry, in milliseconds. Maximum
            is 600,000 ms (10 minutes).
          minimum: 300
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Set the backoff multiplier (2-20) to control the retry frequency
            for failed messages. For faster retries, use a lower multiplier. For
            slower retries with more delay between attempts, use a higher
            multiplier. The multiplier is used in an exponential backoff
            formula; see the Kafka
            [documentation](https://kafka.js.org/docs/retry-detailed) for
            details.
          minimum: 2
          maximum: 20
        authenticationTimeout:
          type: number
          title: Authentication timeout (ms)
          description: Maximum time to wait for Kafka to respond to an authentication
            request
          minimum: 1000
          maximum: 3600000
        reauthenticationThreshold:
          type: number
          title: Reauthentication threshold (ms)
          description: Specifies a time window during which @{product} can reauthenticate
            if needed. Creates the window measuring backward from the moment
            when credentials are set to expire.
          minimum: 1000
          maximum: 1800000
        sasl:
          $ref: "#/components/schemas/AuthenticationType"
        sessionTimeout:
          type: number
          title: Session timeout (ms)
          description: >2-
            
                  Timeout used to detect client failures when using Kafka's group-management facilities.
                  If the client sends no heartbeats to the broker before the timeout expires, 
                  the broker will remove the client from the group and initiate a rebalance.
                  Value must be between the broker's configured group.min.session.timeout.ms and group.max.session.timeout.ms.
                  See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_session.timeout.ms) for details.
          minimum: 1000
          maximum: 3600000
        rebalanceTimeout:
          type: number
          title: Rebalance timeout (ms)
          description: >2-
            
                  Maximum allowed time for each worker to join the group after a rebalance begins.
                  If the timeout is exceeded, the coordinator broker will remove the worker from the group.
                  See [Kafka's documentation](https://kafka.apache.org/documentation/#connectconfigs_rebalance.timeout.ms) for details.
          minimum: 1000
          maximum: 3600000
        heartbeatInterval:
          type: number
          title: Heartbeat interval (ms)
          description: >2-
            
                  Expected time between heartbeats to the consumer coordinator when using Kafka's group-management facilities.
                  Value must be lower than sessionTimeout and typically should not exceed 1/3 of the sessionTimeout value.
                  See [Kafka's documentation](https://kafka.apache.org/documentation/#consumerconfigs_heartbeat.interval.ms) for details.
          minimum: 1000
          maximum: 3600000
        autoCommitInterval:
          type: number
          title: Offset commit interval (ms)
          description: How often to commit offsets. If both this and Offset commit
            threshold are set, @{product} commits offsets when either condition
            is met. If both are empty, @{product} commits offsets after each
            batch.
          minimum: 1000
          maximum: 3600000
        autoCommitThreshold:
          type: number
          title: Offset commit threshold
          description: How many events are needed to trigger an offset commit. If both
            this and Offset commit interval are set, @{product} commits offsets
            when either condition is met. If both are empty, @{product} commits
            offsets after each batch.
          minimum: 1
          maximum: 10000
        maxBytesPerPartition:
          type: number
          title: Byte limit, per partition
          description: Maximum amount of data that Kafka will return per partition, per
            fetch request. Must equal or exceed the maximum message size
            (maxBytesPerPartition) that Kafka is configured to allow. Otherwise,
            @{product} can get stuck trying to retrieve messages. Defaults to
            1048576 (1 MB).
          minimum: 1
          maximum: 10000000
        maxBytes:
          type: number
          title: Byte limit
          description: Maximum number of bytes that Kafka will return per fetch request.
            Defaults to 10485760 (10 MB).
          minimum: 1
          maximum: 1000000000
        maxSocketErrors:
          type: number
          title: Error limit, per socket
          description: Maximum number of network errors before the consumer re-creates a
            socket
          minimum: 0
          maximum: 100
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_brokers:
          type: string
          description: Binds 'brokers' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'brokers' at runtime.
        __template_topics:
          type: string
          description: Binds 'topics' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topics' at runtime.
        __template_groupId:
          type: string
          description: Binds 'groupId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'groupId' at runtime.
    InputGrafana:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - grafana
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep alive timeout (seconds)
          description: Maximum time to wait for additional data, after the last response
            was sent, before closing a socket connection. This can be very
            useful when Grafana Agent remote write's request frequency is high
            so, reusing connections, would help mitigating the cost of creating
            a new connection per request. Note that Grafana Agent's embedded
            Prometheus would attempt to keep connections open for up to 5
            minutes.
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        prometheusAPI:
          type: string
          title: Remote Write API endpoint
          description: "Absolute path on which to listen for Grafana Agent's Remote Write
            requests. Defaults to /api/prom/push, which will expand as:
            'http://<your‑upstream‑URL>:<your‑port>/api/prom/push'. Either this
            field or 'Logs API endpoint' must be configured."
          pattern: ^/
        lokiAPI:
          type: string
          title: Logs API endpoint
          description: "Absolute path on which to listen for Loki logs requests. Defaults
            to /loki/api/v1/push, which will (in this example) expand as:
            'http://<your‑upstream‑URL>:<your‑port>/loki/api/v1/push'. Either
            this field or 'Remote Write API endpoint' must be configured."
          pattern: ^/
        prometheusAuth:
          type: object
          properties:
            authType:
              $ref: "#/components/schemas/AuthenticationTypeOptionsPrometheusAuth"
            username:
              type: string
              title: Username
            password:
              type: string
              title: Password
            token:
              type: string
              title: Token
              description: Bearer token to include in the authorization header
            credentialsSecret:
              type: string
              title: Credentials secret
              description: Select or create a secret that references your credentials
            textSecret:
              type: string
              title: Token (text secret)
              description: Select or create a stored text secret
        lokiAuth:
          type: object
          properties:
            authType:
              $ref: "#/components/schemas/AuthenticationTypeOptionsLokiAuth"
            username:
              type: string
              title: Username
            password:
              type: string
              title: Password
            token:
              type: string
              title: Token
              description: Bearer token to include in the authorization header
            credentialsSecret:
              type: string
              title: Credentials secret
              description: Select or create a secret that references your credentials
            textSecret:
              type: string
              title: Token (text secret)
              description: Select or create a stored text secret
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_prometheusAPI:
          type: string
          description: Binds 'prometheusAPI' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'prometheusAPI' at runtime.
        __template_lokiAPI:
          type: string
          description: Binds 'lokiAPI' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'lokiAPI' at runtime.
      anyOf:
        - required:
            - prometheusAPI
        - required:
            - lokiAPI
    InputLoki:
      type: object
      required:
        - type
        - host
        - port
        - lokiAPI
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - loki
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        lokiAPI:
          type: string
          title: Logs API endpoint
          description: "Absolute path on which to listen for Loki logs requests. Defaults
            to /loki/api/v1/push, which will (in this example) expand as:
            'http://<your‑upstream‑URL>:<your‑port>/loki/api/v1/push'."
          pattern: ^/
        authType:
          $ref: "#/components/schemas/AuthenticationTypeOptionsLokiAuth"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        token:
          type: string
          title: Token
          description: Bearer token to include in the authorization header
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        textSecret:
          type: string
          title: Token (text secret)
          description: Select or create a stored text secret
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_lokiAPI:
          type: string
          description: Binds 'lokiAPI' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'lokiAPI' at runtime.
    InputPrometheusRw:
      type: object
      required:
        - type
        - host
        - port
        - prometheusAPI
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - prometheus_rw
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        prometheusAPI:
          type: string
          title: Remote Write API endpoint
          description: "Absolute path on which to listen for Prometheus requests. Defaults
            to /write, which will expand as:
            http://<your‑upstream‑URL>:<your‑port>/write."
          pattern: ^/
        authType:
          $ref: "#/components/schemas/AuthenticationTypeOptionsPrometheusAuth"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        token:
          type: string
          title: Token
          description: Bearer token to include in the authorization header
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        textSecret:
          type: string
          title: Token (text secret)
          description: Select or create a stored text secret
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_prometheusAPI:
          type: string
          description: Binds 'prometheusAPI' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'prometheusAPI' at runtime.
        __template_username:
          type: string
          description: Binds 'username' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'username' at runtime.
    InputPrometheus:
      type: object
      required:
        - type
        - interval
        - logLevel
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - prometheus
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        dimensionList:
          type: array
          title: Extra dimensions
          minItems: 0
          description: Other dimensions to include in events
          items:
            type: string
            title: dimension
        fieldPerMetric:
          type: boolean
          title: Use field per metric
          description: "When enabled, each metric name is used as the event field key
            (example: go_threads: 9) instead of the default _metric/_value
            format."
        discoveryType:
          title: Discovery type
          type: string
          enum:
            - static
            - dns
            - ec2
            - http_sd
          x-speakeasy-enum-descriptions:
            - Static
            - DNS
            - AWS EC2
            - HTTP SD
          description: Target discovery mechanism. Use static to manually enter a list of
            targets.
          x-speakeasy-unknown-values: allow
        interval:
          type: number
          title: Poll interval
          description: How often, in minutes, to scrape targets for metrics. Maximum of 60
            minutes. 60 must be evenly divisible by the value you enter.
          minimum: 1
          maximum: 60
        logLevel:
          $ref: "#/components/schemas/LogLevelOptions"
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        timeout:
          type: number
          title: HTTP connection timeout
          description: Time, in seconds, before aborting HTTP connection attempts; use 0
            for no timeout
          minimum: 0
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        jobTimeout:
          type: string
          title: Job timeout
          description: Maximum time the job is allowed to run (e.g., 30, 45s or 15m).
            Units are seconds, if not specified. Enter 0 for unlimited time.
          pattern: ^\d+[sm]?$
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSasl"
        description:
          type: string
          title: Description
        targetList:
          type: array
          title: Targets
          minItems: 1
          description: "List of Prometheus targets to pull metrics from. Values can be in
            URL or host[:port] format. For example:
            http://localhost:9090/metrics, localhost:9090, or localhost. In
            cases where just host[:port] is specified, the endpoint will resolve
            to 'http://host[:port]/metrics'."
          items:
            type: string
            title: Targets
        recordType:
          $ref: "#/components/schemas/RecordTypeOptions"
        scrapePort:
          type: number
          title: Metrics port
          description: The port number in the metrics URL for discovered targets
          minimum: 1
          maximum: 65535
        nameList:
          type: array
          title: DNS names
          minItems: 1
          description: List of DNS names to resolve
          items:
            type: string
            title: DNS names
        scrapeProtocol:
          type: string
          title: Metrics protocol
          enum:
            - http
            - https
          description: Protocol to use when collecting metrics
          x-speakeasy-unknown-values: allow
        scrapePath:
          type: string
          title: Metrics path
          description: Path to use when collecting metrics from discovered targets
          pattern: ^/.*
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        usePublicIp:
          type: boolean
          title: Use public IP
          description: Use public IP address for discovered targets. Disable to use the
            private IP address.
        searchFilter:
          title: Search filter
          description: Filter to apply when searching for EC2 instances
          type: array
          items:
            $ref: "#/components/schemas/SearchFilterConfInputPrometheus"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: Region where the EC2 is located
        endpoint:
          type: string
          title: Endpoint
          description: EC2 service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to EC2-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        enableAssumeRole:
          type: boolean
          title: Enable for EC2
          description: Use Assume Role credentials to access EC2
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        httpDiscoveryUrl:
          type: string
          title: Discovery URL
          description: URL to fetch target groups from (must be http or https)
          pattern: ^https?://
        httpDiscoveryHeaders:
          type: array
          title: HTTP headers
          description: Extra headers to send with the discovery request
          items:
            $ref: "#/components/schemas/HttpDiscoveryHeaderConfInputPrometheus"
        httpDiscoveryRejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject TLS certificates that cannot be verified for the discovery
            endpoint. Falls back to the source-level setting if not specified.
        maxResponseBodySize:
          type: string
          title: Max response body size
          description: Maximum size of the HTTP SD response body. Responses exceeding this
            limit will be rejected. Defaults to 20 MB.
        username:
          type: string
          title: Username
          description: Username for Prometheus Basic authentication
        password:
          type: string
          title: Password
          description: Password for Prometheus Basic authentication
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_dimensionList:
          type: string
          description: Binds 'dimensionList' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'dimensionList' at runtime.
        __template_discoveryType:
          type: string
          description: Binds 'discoveryType' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'discoveryType' at runtime.
        __template_logLevel:
          type: string
          description: Binds 'logLevel' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'logLevel' at runtime.
        __template_targetList:
          type: string
          description: Binds 'targetList' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'targetList' at runtime.
        __template_nameList:
          type: string
          description: Binds 'nameList' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'nameList' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_username:
          type: string
          description: Binds 'username' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'username' at runtime.
        __template_password:
          type: string
          description: Binds 'password' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'password' at runtime.
    InputEdgePrometheus:
      type: object
      required:
        - type
        - interval
        - discoveryType
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - edge_prometheus
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        dimensionList:
          type: array
          title: Extra Dimensions
          minItems: 0
          description: Other dimensions to include in events
          items:
            type: string
            title: dimension
        fieldPerMetric:
          type: boolean
          title: Use field per metric
          description: "When enabled, each metric name is used as the event field key
            (example: go_threads: 9) instead of the default _metric/_value
            format."
        discoveryType:
          title: Discovery type
          type: string
          enum:
            - static
            - dns
            - ec2
            - k8s-node
            - k8s-pods
            - k8s-service-monitor
            - http_sd
          x-speakeasy-enum-descriptions:
            - Static
            - DNS
            - AWS EC2
            - Kubernetes Node
            - Kubernetes Pods
            - Kubernetes Service Monitor (v4.18+)
            - HTTP SD
          description: Target discovery mechanism. Use static to manually enter a list of
            targets.
          x-speakeasy-unknown-values: allow
        interval:
          type: number
          title: Poll Interval
          description: How often in seconds to scrape targets for metrics.
          minimum: 2
        timeout:
          type: number
          title: HTTP Connection Timeout
          description: Timeout, in milliseconds, before aborting HTTP connection attempts;
            1-60000 or 0 to disable
          maximum: 60000
          minimum: 0
        persistence:
          $ref: "#/components/schemas/DiskSpoolingType"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        authType:
          title: Authentication method
          type: string
          enum:
            - manual
            - secret
            - kubernetes
          description: Enter credentials directly, or select a stored secret
          x-speakeasy-unknown-values: allow
        description:
          type: string
          title: Description
        targets:
          type: array
          title: Targets
          minItems: 1
          items:
            type: object
            required:
              - host
            properties:
              protocol:
                $ref: "#/components/schemas/ProtocolOptionsTargetsItems"
              host:
                type: string
                title: Host
                description: Name of host from which to pull metrics.
              port:
                type: number
                title: Port
                description: The port number in the metrics URL for discovered targets.
                minimum: 1
                maximum: 65535
              path:
                type: string
                title: Path
                description: Path to use when collecting metrics from discovered targets
                pattern: ^/.*
        recordType:
          $ref: "#/components/schemas/RecordTypeOptions"
        scrapePort:
          type: number
          title: Port
          description: The port number in the metrics URL for discovered targets.
          minimum: 1
          maximum: 65535
        nameList:
          type: array
          title: DNS names
          minItems: 1
          description: List of DNS names to resolve
          items:
            type: string
            title: DNS names
        scrapeProtocol:
          $ref: "#/components/schemas/ProtocolOptionsTargetsItems"
        scrapePath:
          type: string
          title: Path
          description: Path to use when collecting metrics from discovered targets
          pattern: ^/.*
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        usePublicIp:
          type: boolean
          title: Use public IP
          description: Use public IP address for discovered targets. Disable to use the
            private IP address.
        searchFilter:
          title: Search filter
          description: Filter to apply when searching for EC2 instances
          type: array
          items:
            $ref: "#/components/schemas/SearchFilterConfInputPrometheus"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: Region where the EC2 is located
        endpoint:
          type: string
          title: Endpoint
          description: EC2 service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to EC2-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        enableAssumeRole:
          type: boolean
          title: Enable for EC2
          description: Use Assume Role credentials to access EC2
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        serviceMonitorNamespace:
          type: string
          title: ServiceMonitor Namespace
          description: "Namespace to search for ServiceMonitor resources. Leave empty to
            search in all namespaces. Note: Kubernetes Service Monitor discovery
            requires Cribl Edge version 4.18 or greater. Nodes running an older
            version with this option configured will report an error due to
            configuration schema validation failure."
        scrapeProtocolExpr:
          type: string
          title: Protocol
          description: Protocol to use when collecting metrics
        scrapePortExpr:
          type: string
          title: Port
          description: The port number in the metrics URL for discovered targets.
        scrapePathExpr:
          type: string
          title: Path
          description: Path to use when collecting metrics from discovered targets
        podFilter:
          type: array
          title: Filter Rules
          description: |2
            
              Add rules to decide which pods to discover for metrics.
              Pods are searched if no rules are given or of all the rules'
              expressions evaluate to true.
          items:
            type: object
            required:
              - filter
            properties:
              filter:
                type: string
                title: Filter Expression
                description: JavaScript expression applied to pods objects. Return 'true' to
                  include it.
              description:
                type: string
                title: Description
                description: Optional description of this rule's purpose
        httpDiscoveryUrl:
          type: string
          title: Discovery URL
          description: URL to fetch target groups from (must be http or https)
          pattern: ^https?://
        httpDiscoveryHeaders:
          type: array
          title: HTTP headers
          description: Extra headers to send with the discovery request
          items:
            $ref: "#/components/schemas/HttpDiscoveryHeaderConfInputPrometheus"
        httpDiscoveryRejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject TLS certificates that cannot be verified for the discovery
            endpoint. Falls back to the source-level setting if not specified.
        maxResponseBodySize:
          type: string
          title: Max response body size
          description: Maximum size of the HTTP SD response body. Responses exceeding this
            limit will be rejected. Defaults to 20 MB.
        username:
          type: string
          title: Username
          description: Username for Prometheus Basic authentication
        password:
          type: string
          title: Password
          description: Password for Prometheus Basic authentication
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_dimensionList:
          type: string
          description: Binds 'dimensionList' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'dimensionList' at runtime.
        __template_nameList:
          type: string
          description: Binds 'nameList' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'nameList' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
    InputOffice365Mgmt:
      type: object
      required:
        - type
        - tenantId
        - appId
        - planType
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - office365_mgmt
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        planType:
          $ref: "#/components/schemas/SubscriptionPlanOptions"
        tenantId:
          type: string
          title: Tenant ID
          description: Microsoft 365 Azure Tenant ID
        appId:
          type: string
          title: App ID
          description: Microsoft 365 Azure Application ID
        timeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout, use 0 to disable
          minimum: 0
          maximum: 2400
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        jobTimeout:
          type: string
          title: Job timeout
          description: Maximum time the job is allowed to run (e.g., 30, 45s or 15m).
            Units are seconds, if not specified. Enter 0 for unlimited time.
          pattern: ^\d+[sm]?$
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        publisherIdentifier:
          type: string
          title: Publisher Identifier
          description: Optional Publisher Identifier to use in API requests, defaults to
            tenant id if not defined. For more information see
            [here](https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference#start-a-subscription)
        contentConfig:
          type: array
          title: Content Types
          items:
            type: object
            properties:
              contentType:
                type: string
                title: Content Type
                description: Microsoft 365 Management Activity API Content Type
              description:
                type: string
                title: Interval Description
                description: If interval type is minutes the value entered must evenly divisible
                  by 60 or save will fail
              interval:
                type: number
                title: Interval
                minimum: 1
                maximum: 60
              logLevel:
                $ref: "#/components/schemas/LogLevelOptionsContentConfigItems"
              enabled:
                type: boolean
                title: Enabled
          description: "Enable Microsoft 365 Management Activity API content types and
            polling intervals. Polling intervals are used to set up search date
            range and cron schedule, e.g.: */${interval} * * * *. Because of
            this, intervals entered must be evenly divisible by 60 to give a
            predictable schedule."
        ingestionLag:
          type: number
          title: Ingestion lag (minutes)
          description: Use this setting to account for ingestion lag. This is necessary
            because there can be a lag of 60 - 90 minutes (or longer) before
            Microsoft 365 events are available for retrieval.
          minimum: 0
          maximum: 7200
        retryRules:
          $ref: "#/components/schemas/RetryRulesTypeCodesEnableHeader"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsManualSecret"
        description:
          type: string
          title: Description
        clientSecret:
          type: string
          title: Client secret
          description: Microsoft 365 Azure client secret
        textSecret:
          type: string
          title: Client secret (text secret)
          description: Select or create a stored text secret
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_planType:
          type: string
          description: Binds 'planType' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'planType' at runtime.
        __template_tenantId:
          type: string
          description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tenantId' at runtime.
        __template_appId:
          type: string
          description: Binds 'appId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'appId' at runtime.
        __template_publisherIdentifier:
          type: string
          description: Binds 'publisherIdentifier' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'publisherIdentifier' at runtime.
        __template_clientSecret:
          type: string
          description: Binds 'clientSecret' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientSecret' at runtime.
    InputOffice365Service:
      type: object
      required:
        - type
        - tenantId
        - appId
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - office365_service
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        planType:
          $ref: "#/components/schemas/SubscriptionPlanOptions"
        tenantId:
          type: string
          title: Tenant ID
          description: Microsoft 365 Azure Tenant ID
        appId:
          type: string
          title: App ID
          description: Microsoft 365 Azure Application ID
        timeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout, use 0 to disable
          minimum: 0
          maximum: 2400
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        jobTimeout:
          type: string
          title: Job timeout
          description: Maximum time the job is allowed to run (e.g., 30, 45s or 15m).
            Units are seconds, if not specified. Enter 0 for unlimited time.
          pattern: ^\d+[sm]?$
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        contentConfig:
          type: array
          title: Content Types
          items:
            type: object
            properties:
              contentType:
                type: string
                title: Content Type
                description: Microsoft 365 Services API Content Type
              description:
                type: string
                title: Interval Description
                description: If interval type is minutes the value entered must evenly divisible
                  by 60 or save will fail
              interval:
                type: number
                title: Interval
                minimum: 0
                maximum: 60
              logLevel:
                $ref: "#/components/schemas/LogLevelOptionsContentConfigItems"
              enabled:
                type: boolean
                title: Enabled
          description: "Enable Microsoft 365 Service Communication API content types and
            polling intervals. Polling intervals are used to set up search date
            range and cron schedule, e.g.: */${interval} * * * *. Because of
            this, intervals entered for current and historical status must be
            evenly divisible by 60 to give a predictable schedule."
        retryRules:
          $ref: "#/components/schemas/RetryRulesTypeCodesEnableHeader"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsManualSecret"
        description:
          type: string
          title: Description
        clientSecret:
          type: string
          title: Client secret
          description: Microsoft 365 Azure client secret
        textSecret:
          type: string
          title: Client secret (text secret)
          description: Select or create a stored text secret
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_planType:
          type: string
          description: Binds 'planType' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'planType' at runtime.
        __template_tenantId:
          type: string
          description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tenantId' at runtime.
        __template_appId:
          type: string
          description: Binds 'appId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'appId' at runtime.
        __template_clientSecret:
          type: string
          description: Binds 'clientSecret' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientSecret' at runtime.
    InputOffice365MsgTrace:
      type: object
      required:
        - type
        - url
        - interval
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - office365_msg_trace
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        url:
          title: Report URL
          type: string
          description: URL to use when retrieving report data.
        interval:
          type: integer
          title: Poll interval
          description: How often (in minutes) to run the report. Must divide evenly into
            60 minutes to create a predictable schedule, or Save will fail.
          minimum: 1
          maximum: 60
        startDate:
          title: Date range start
          type: string
          description: "Backward offset for the search range's head. (E.g.: -3h@h) Message
            Trace data is delayed; this parameter (with Date range end)
            compensates for delay and gaps."
        endDate:
          title: Date range end
          type: string
          description: "Backward offset for the search range's tail. (E.g.: -2h@h) Message
            Trace data is delayed; this parameter (with Date range start)
            compensates for delay and gaps."
        timeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout. Maximum is 2400 (40 minutes);
            enter 0 to wait indefinitely.
          minimum: 0
          maximum: 2400
        disableTimeFilter:
          type: boolean
          title: Disable time filter
          description: Disables time filtering of events when a date range is specified.
        authType:
          title: Authentication method
          type: string
          enum:
            - manual
            - secret
            - oauth
            - oauthSecret
            - oauthCert
          description: Select authentication method.
          x-speakeasy-unknown-values: allow
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        jobTimeout:
          title: Job timeout
          type: string
          description: "Maximum time the job is allowed to run. Time unit defaults to
            seconds if not specified (examples: 30, 45s, 15m). Enter 0 for
            unlimited time."
          pattern: \d+[sm]?$
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        rescheduleDroppedTasks:
          type: boolean
          title: Reschedule tasks
          description: Reschedule tasks that failed with non-fatal errors
        maxTaskReschedule:
          type: number
          title: Task reschedule limit
          description: Maximum number of times a task can be rescheduled
          minimum: 1
        logLevel:
          $ref: "#/components/schemas/LogLevelOptionsDebugError"
        retryRules:
          $ref: "#/components/schemas/RetryRulesTypeCodesEnableHeader"
        description:
          type: string
          title: Description
        username:
          type: string
          title: Username
          description: Username to run Message Trace API call.
        password:
          type: string
          title: Password
          description: Password to run Message Trace API call.
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials.
        clientSecret:
          type: string
          title: Client secret
          description: client_secret to pass in the OAuth request parameter.
        tenantId:
          type: string
          title: Tenant identifier
          description: Directory ID (tenant identifier) in Azure Active Directory.
        clientId:
          type: string
          title: Client ID
          description: client_id to pass in the OAuth request parameter.
        resource:
          type: string
          title: Resource
          description: Resource to pass in the OAuth request parameter.
        planType:
          $ref: "#/components/schemas/SubscriptionPlanOptions"
        textSecret:
          type: string
          title: Client secret
          description: Select or create a secret that references your client_secret to
            pass in the OAuth request parameter.
        certOptions:
          $ref: "#/components/schemas/CertOptionsType"
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_tenantId:
          type: string
          description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tenantId' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
        __template_resource:
          type: string
          description: Binds 'resource' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'resource' at runtime.
        __template_planType:
          type: string
          description: Binds 'planType' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'planType' at runtime.
    InputMicrosoftGraph:
      type: object
      required:
        - type
        - url
        - interval
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - microsoft_graph
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        url:
          title: Endpoint
          type: string
          description: Microsoft Graph API endpoint URL. (ex.
            https://graph.microsoft.com/v1.0/admin/exchange/tracing/messageTraces)
        interval:
          type: integer
          title: Poll interval
          description: How often (in minutes) to run the report. Must divide evenly into
            60 minutes to create a predictable schedule, or Save will fail.
          minimum: 1
          maximum: 60
        startDate:
          title: Date range start
          type: string
          description: "Backward offset for the search range's head. (E.g.: -3h@h)
            Microsoft Graph data is delayed; this parameter (with Date range
            end) compensates for delay and gaps."
        endDate:
          title: Date range end
          type: string
          description: "Backward offset for the search range's tail. (E.g.: -2h@h)
            Microsoft Graph data is delayed; this parameter (with Date range
            start) compensates for delay and gaps."
        timeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout. Maximum is 2400 (40 minutes);
            enter 0 to wait indefinitely.
          minimum: 0
          maximum: 2400
        disableTimeFilter:
          type: boolean
          title: Disable time filter
          description: Disables time filtering of events when a date range is specified.
        maxPages:
          type: integer
          title: Page limit
          description: Maximum number of pages to retrieve per collection task. Set to 0
            to retrieve all pages.
          minimum: 0
        authType:
          title: Authentication method
          type: string
          enum:
            - oauth
            - oauthSecret
            - oauthCert
          description: Select authentication method.
          x-speakeasy-unknown-values: allow
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        jobTimeout:
          title: Job timeout
          type: string
          description: "Maximum time the job is allowed to run. Time unit defaults to
            seconds if not specified (examples: 30, 45s, 15m). Enter 0 for
            unlimited time."
          pattern: \d+[sm]?$
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        rescheduleDroppedTasks:
          type: boolean
          title: Reschedule tasks
          description: Reschedule tasks that failed with non-fatal errors
        maxTaskReschedule:
          type: number
          title: Task reschedule limit
          description: Maximum number of times a task can be rescheduled
          minimum: 1
        logLevel:
          $ref: "#/components/schemas/LogLevelOptionsDebugError"
        retryRules:
          $ref: "#/components/schemas/RetryRulesTypeCodesEnableHeader"
        description:
          type: string
          title: Description
        clientSecret:
          type: string
          title: Client secret
          description: client_secret to pass in the OAuth request parameter.
        tenantId:
          type: string
          title: Tenant identifier
          description: Directory ID (tenant identifier) in Azure Active Directory.
        clientId:
          type: string
          title: Client ID
          description: client_id to pass in the OAuth request parameter.
        resource:
          type: string
          title: Resource
          description: Resource to pass in the OAuth request parameter.
        planType:
          type: string
          title: Subscription plan
          description: Microsoft 365 subscription plan for your organization, typically
            Microsoft 365 Enterprise
          enum:
            - enterprise_gcc
            - gcc
            - gcc_high
            - dod
            - china
          x-speakeasy-enum-descriptions:
            - Microsoft 365 Enterprise
            - Microsoft 365 GCC
            - Microsoft 365 GCC High
            - Microsoft 365 DoD
            - Microsoft 365 China (21Vianet)
          x-speakeasy-unknown-values: allow
        textSecret:
          type: string
          title: Client secret
          description: Select or create a secret that references your client_secret to
            pass in the OAuth request parameter.
        certOptions:
          $ref: "#/components/schemas/CertOptionsType"
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_tenantId:
          type: string
          description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tenantId' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
        __template_resource:
          type: string
          description: Binds 'resource' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'resource' at runtime.
        __template_planType:
          type: string
          description: Binds 'planType' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'planType' at runtime.
    InputEventhub:
      type: object
      required:
        - type
        - brokers
        - topics
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - eventhub
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        brokers:
          type: array
          title: Brokers
          description: "List of Event Hubs Kafka brokers to connect to (example:
            yourdomain.servicebus.windows.net:9093). The hostname can be found
            in the host portion of the primary or secondary connection string in
            Shared Access Policies."
          minItems: 1
          items:
            type: string
            minLength: 1
        topics:
          type: array
          title: Event Hub name
          description: "The name of the Event Hub (Kafka topic) to subscribe to. Warning:
            To optimize performance, Cribl suggests subscribing each Event Hubs
            Source to only a single topic."
          minItems: 1
          items:
            type: string
            minLength: 1
        groupId:
          type: string
          title: Group ID
          description: The consumer group this instance belongs to. Default is 'Cribl'.
        fromBeginning:
          type: boolean
          title: From beginning
          description: Start reading from earliest available data; relevant only during
            initial subscription
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a connection to complete successfully
          minimum: 1000
          maximum: 3600000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for Kafka to respond to a request
          minimum: 1000
          maximum: 3600000
        maxRetries:
          type: number
          title: Retry limit
          description: If messages are failing, you can set the maximum number of retries
            as high as 100 to prevent loss of data
          minimum: 0
          maximum: 100
        maxBackOff:
          type: number
          title: Backoff limit (ms)
          description: The maximum wait time for a retry, in milliseconds. Default (and
            minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180
            seconds).
          minimum: 30000
          maximum: 180000
        initialBackoff:
          type: number
          title: Initial retry interval (ms)
          description: Initial value used to calculate the retry, in milliseconds. Maximum
            is 600,000 ms (10 minutes).
          minimum: 300
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Set the backoff multiplier (2-20) to control the retry frequency
            for failed messages. For faster retries, use a lower multiplier. For
            slower retries with more delay between attempts, use a higher
            multiplier. The multiplier is used in an exponential backoff
            formula; see the Kafka
            [documentation](https://kafka.js.org/docs/retry-detailed) for
            details.
          minimum: 2
          maximum: 20
        authenticationTimeout:
          type: number
          title: Authentication timeout (ms)
          description: Maximum time to wait for Kafka to respond to an authentication
            request
          minimum: 1000
          maximum: 3600000
        reauthenticationThreshold:
          type: number
          title: Reauthentication threshold (ms)
          description: Specifies a time window during which @{product} can reauthenticate
            if needed. Creates the window measuring backward from the moment
            when credentials are set to expire.
          minimum: 1000
          maximum: 1800000
        sasl:
          $ref: "#/components/schemas/AuthenticationTypeUse"
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideType"
        sessionTimeout:
          type: number
          title: Session timeout (ms)
          description: >2-
            
                  Timeout (session.timeout.ms in Kafka domain) used to detect client failures when using Kafka's group-management facilities.
                  If the client sends no heartbeats to the broker before the timeout expires, the broker will remove the client from the group and initiate a rebalance.
                  Value must be lower than rebalanceTimeout.
                  See details [here](https://github.com/Azure/azure-event-hubs-for-kafka/blob/master/CONFIGURATION.md).
          minimum: 6000
          maximum: 300000
        rebalanceTimeout:
          type: number
          title: Rebalance timeout (ms)
          description: >2-
            
                  Maximum allowed time (rebalance.timeout.ms in Kafka domain) for each worker to join the group after a rebalance begins.
                  If the timeout is exceeded, the coordinator broker will remove the worker from the group.
                  See [Recommended configurations](https://github.com/Azure/azure-event-hubs-for-kafka/blob/master/CONFIGURATION.md).
          minimum: 1000
          maximum: 3600000
        heartbeatInterval:
          type: number
          title: Heartbeat interval (ms)
          description: >2-
            
                  Expected time (heartbeat.interval.ms in Kafka domain) between heartbeats to the consumer coordinator when using Kafka's group-management facilities.
                  Value must be lower than sessionTimeout and typically should not exceed 1/3 of the sessionTimeout value.
                  See [Recommended configurations](https://github.com/Azure/azure-event-hubs-for-kafka/blob/master/CONFIGURATION.md).
          minimum: 1000
          maximum: 3600000
        autoCommitInterval:
          type: number
          title: Offset commit interval (ms)
          description: How often to commit offsets. If both this and Offset commit
            threshold are set, @{product} commits offsets when either condition
            is met. If both are empty, @{product} commits offsets after each
            batch.
          minimum: 1000
          maximum: 3600000
        autoCommitThreshold:
          type: number
          title: Offset commit threshold
          description: How many events are needed to trigger an offset commit. If both
            this and Offset commit interval are set, @{product} commits offsets
            when either condition is met. If both are empty, @{product} commits
            offsets after each batch.
          minimum: 1
          maximum: 10000
        maxBytesPerPartition:
          type: number
          title: Byte limit, per partition
          description: Maximum amount of data that Kafka will return per partition, per
            fetch request. Must equal or exceed the maximum message size
            (maxBytesPerPartition) that Kafka is configured to allow. Otherwise,
            @{product} can get stuck trying to retrieve messages. Defaults to
            1048576 (1 MB).
          minimum: 1
          maximum: 10000000
        maxBytes:
          type: number
          title: Byte limit
          description: Maximum number of bytes that Kafka will return per fetch request.
            Defaults to 10485760 (10 MB).
          minimum: 1
          maximum: 1000000000
        maxSocketErrors:
          type: number
          title: Error limit, per socket
          description: Maximum number of network errors before the consumer re-creates a
            socket
          minimum: 0
          maximum: 100
        minimizeDuplicates:
          type: boolean
          title: Minimize duplicates
          description: Minimize duplicate events by starting only one consumer for each
            topic partition
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_brokers:
          type: string
          description: Binds 'brokers' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'brokers' at runtime.
        __template_topics:
          type: string
          description: Binds 'topics' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topics' at runtime.
        __template_groupId:
          type: string
          description: Binds 'groupId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'groupId' at runtime.
    InputEventhubAmqp:
      type: object
      required:
        - type
        - consumerGroup
        - checkpointing
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - eventhub_amqp
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        eventHubName:
          type: string
          title: Event Hub name
          description: The name of the Event Hub to consume from
          minLength: 1
        consumerGroup:
          type: string
          title: Consumer group
          description: The consumer group this instance belongs to. Default is '$Default'.
          minLength: 1
        auth:
          type: object
          required:
            - mechanism
          properties:
            mechanism:
              type: string
              enum:
                - connection-string
                - oauth-bearer
              x-speakeasy-enum-descriptions:
                - Connection String
                - OAuth Bearer
              title: Authentication mechanism
              x-speakeasy-unknown-values: allow
            textSecret:
              type: string
              title: Connection string (text secret)
              description: Select or create a stored text secret
            clientSecretAuthType:
              $ref: "#/components/schemas/AuthenticationMethodOptionsAuth"
            clientTextSecret:
              type: string
              title: Client Secret (text secret)
              description: Select or create a stored text secret
            certificate:
              type: object
              required:
                - certificateName
                - certPath
                - privKeyPath
              properties:
                certificateName:
                  type: string
                  title: Certificate
                  description: The certificate you registered as credentials for your app in the
                    Azure portal
                certPath:
                  type: string
                  title: Certificate path
                  description: Path on server containing certificates to use. PEM format. Can
                    reference $ENV_VARS.
                privKeyPath:
                  type: string
                  title: Private key path
                  description: Path on server containing the private key to use. PEM format. Can
                    reference $ENV_VARS.
                passphrase:
                  type: string
                  title: Passphrase
                  description: Passphrase to use to decrypt private key
            oauthEndpoint:
              $ref: "#/components/schemas/MicrosoftEntraIdAuthenticationEndpointOptionsSasl"
            clientId:
              type: string
              title: Client ID
              description: client_id to pass in the OAuth request parameter
            tenantId:
              type: string
              title: Tenant identifier
              description: Directory ID (tenant identifier) in Azure Active Directory
            fullyQualifiedNamespace:
              type: string
              title: Fully qualified namespace
              description: The fully qualified Event Hubs namespace that the consumer is
                associated with. This is likely to be similar to
                {yournamespace}.servicebus.windows.net.
            __template_oauthEndpoint:
              type: string
              description: Binds 'oauthEndpoint' to a variable for dynamic value resolution.
                Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'oauthEndpoint' at
                runtime.
            __template_clientId:
              type: string
              description: Binds 'clientId' to a variable for dynamic value resolution. Set to
                variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'clientId' at runtime.
            __template_tenantId:
              type: string
              description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
                variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'tenantId' at runtime.
            __template_fullyQualifiedNamespace:
              type: string
              description: Binds 'fullyQualifiedNamespace' to a variable for dynamic value
                resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
                prefixed ID (group-scoped). Variable value overrides
                'fullyQualifiedNamespace' at runtime.
        checkpointing:
          type: object
          required:
            - blobStore
          properties:
            blobStore:
              type: object
              title: Azure Blob Storage
              required:
                - containerName
              properties:
                containerName:
                  type: string
                  title: Container name
                  description: Azure Blob Storage container used to store checkpoints. Must be
                    3–63 lowercase alphanumeric characters or hyphens.
                  minLength: 3
                  maxLength: 63
                  pattern: ^[a-z0-9](-?[a-z0-9])*$
                authType:
                  title: Authentication method
                  type: string
                  enum:
                    - secret
                    - clientSecret
                    - clientCert
                    - clientAssertion
                    - clientAssertion_rpc
                  x-speakeasy-unknown-values: allow
                textSecret:
                  type: string
                  title: Connection string (text secret)
                  description: Select or create a stored text secret
                storageAccountName:
                  type: string
                  title: Storage account name
                  description: The name of your Azure storage account
                tenantId:
                  type: string
                  title: Tenant ID
                  description: The service principal's tenant ID
                clientId:
                  type: string
                  title: Client ID
                  description: The service principal's client ID
                azureCloud:
                  type: string
                  title: Azure Cloud
                  description: The Azure cloud to use. Defaults to Azure Public Cloud.
                endpointSuffix:
                  type: string
                  title: Endpoint suffix
                  description: Endpoint suffix for the service URL. Takes precedence over the
                    Azure Cloud setting. Defaults to core.windows.net.
                clientTextSecret:
                  type: string
                  title: Client secret (text secret)
                  description: Select or create a stored text secret
                certificate:
                  $ref: "#/components/schemas/CertificateTypeAzureBlobAuthTypeClientCert"
                __template_storageAccountName:
                  type: string
                  description: Binds 'storageAccountName' to a variable for dynamic value
                    resolution. Set to variable ID (pack-scoped) or
                    'cribl.'/'edge.' prefixed ID (group-scoped). Variable value
                    overrides 'storageAccountName' at runtime.
                __template_tenantId:
                  type: string
                  description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
                    variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                    (group-scoped). Variable value overrides 'tenantId' at
                    runtime.
                __template_clientId:
                  type: string
                  description: Binds 'clientId' to a variable for dynamic value resolution. Set to
                    variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                    (group-scoped). Variable value overrides 'clientId' at
                    runtime.
                __template_azureCloud:
                  type: string
                  description: Binds 'azureCloud' to a variable for dynamic value resolution. Set
                    to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                    (group-scoped). Variable value overrides 'azureCloud' at
                    runtime.
        fromBeginning:
          type: boolean
          title: From beginning
          description: Start reading from earliest available data; relevant only during
            initial subscription
        maxBatchSize:
          type: integer
          minimum: 1
          title: Max batch size
          description: Maximum number of events in each batch delivered to the consumer
        maxWaitTimeInSeconds:
          type: integer
          minimum: 1
          title: Max wait time (secs)
          description: Maximum time to wait for a batch of events before delivering a
            partial batch
        prefetchCount:
          type: integer
          minimum: 1
          title: Prefetch count
          description: Number of events to prefetch from the service for processing
        maxRetries:
          type: integer
          minimum: 0
          title: Retry limit
          description: Maximum number of retries per operation
        initialBackoff:
          type: integer
          minimum: 300
          title: Initial retry interval (ms)
          description: Initial delay before the first retry, in milliseconds
        maxBackoff:
          type: integer
          minimum: 30000
          title: Backoff limit (ms)
          description: Maximum delay between retries, in milliseconds
        timeoutInMs:
          type: integer
          minimum: 1000
          title: Request timeout (ms)
          description: Maximum time to wait for a request to complete
        connectionInitialBackoff:
          type: integer
          minimum: 1
          title: Connection initial retry interval (ms)
          description: Initial delay before the first reconnection attempt, in milliseconds
        connectionMaxBackoff:
          type: integer
          minimum: 1
          title: Connection backoff limit (ms)
          description: Maximum delay between reconnection attempts, in milliseconds
        connectionTimeoutInMs:
          type: integer
          minimum: 1000
          title: Connection timeout (ms)
          description: Maximum time to wait for a connection to complete
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    InputExec:
      type: object
      required:
        - type
        - command
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          enum:
            - exec
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        command:
          type: string
          title: Command
          description: Command to execute; supports Bourne shell (or CMD on Windows) syntax
        script:
          type: string
          title: Script
          description: Optional script content to pipe into the command's stdin. The stdin
            stream is closed after the script is written.
        retries:
          type: number
          title: Retry limit
          description: Maximum number of retry attempts in the event that the command fails
          minimum: 0
        scheduleType:
          title: Schedule type
          type: string
          enum:
            - interval
            - cronSchedule
          description: Select a schedule type; either an interval (in seconds) or a
            cron-style schedule.
          x-speakeasy-unknown-values: allow
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        interval:
          type: number
          title: Interval
          description: Interval between command executions in seconds.
          minimum: 1
        cronSchedule:
          type: string
          title: Schedule
          description: Cron schedule to execute the command on.
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    InputFirehose:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - firehose
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        authTokens:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            type: string
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_authTokens:
          type: string
          description: Binds 'authTokens' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'authTokens' at runtime.
    InputGooglePubsub:
      type: object
      required:
        - type
        - subscriptionName
        - topicName
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - google_pubsub
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        topicName:
          type: string
          title: Topic ID
          description: ID of the topic to receive events from. When Monitor subscription
            is enabled, any value may be entered.
        subscriptionName:
          type: string
          title: Subscription ID
          description: "ID of the subscription to use when receiving events. When Monitor
            subscription is enabled, the fully qualified subscription name must
            be entered. Example:
            projects/myProject/subscriptions/mySubscription"
        monitorSubscription:
          type: boolean
          title: Monitor subscription for new messages
          description: Use when the subscription is not created by this Source and topic
            is not known
        createTopic:
          type: boolean
          title: Create topic
          description: Create topic if it does not exist
        createSubscription:
          type: boolean
          title: Create subscription
          description: Create subscription if it does not exist
        region:
          type: string
          title: Region
          description: Region to retrieve messages from. Select 'default' to allow Google
            to auto-select the nearest region. When using ordered delivery, the
            selected region must be allowed by message storage policy.
        googleAuthMethod:
          $ref: "#/components/schemas/GoogleAuthenticationMethodOptions"
        serviceAccountCredentials:
          type: string
          title: Service account credentials
          description: Contents of service account credentials (JSON keys) file downloaded
            from Google Cloud. To upload a file, click the upload button at this
            field's upper right.
        secret:
          type: string
          title: Service account credentials (text secret)
          description: Select or create a stored text secret
        maxBacklog:
          type: number
          title: Backlog limit
          description: If Destination exerts backpressure, this setting limits how many
            inbound events Stream will queue for processing before it stops
            retrieving events
          minimum: 1
        concurrency:
          type: number
          title: Number of concurrent streams
          description: How many streams to pull messages from at one time. Doubling the
            value doubles the number of messages this Source pulls from the
            topic (if available), while consuming more CPU and memory. Defaults
            to 5.
          minimum: 1
          maximum: 100
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Pull request timeout, in milliseconds
          minimum: 10000
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        orderedDelivery:
          type: boolean
          title: Ordered delivery
          description: Receive events in the order they were added to the queue. The
            process sending events must have ordering enabled.
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_topicName:
          type: string
          description: Binds 'topicName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topicName' at runtime.
        __template_subscriptionName:
          type: string
          description: Binds 'subscriptionName' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'subscriptionName' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
    InputCribl:
      type: object
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - cribl
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        filter:
          type: string
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    InputCriblTcp:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - cribl_tcp
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveCxn:
          type: number
          title: Active connection limit
          description: Maximum number of active connections allowed per Worker Process.
            Use 0 for unlimited.
          minimum: 0
        socketIdleTimeout:
          type: number
          title: Socket idle timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. After this time, the connection will be
            closed. Leave at 0 for no inactive socket monitoring.
          minimum: 0
        socketEndingMaxWait:
          type: number
          title: Forced socket termination timeout (seconds)
          description: How long the server will wait after initiating a closure for a
            client to close its end of the connection. If the client doesn't
            close the connection within this time, the server will forcefully
            terminate the socket to prevent resource leaks and ensure efficient
            connection cleanup and system stability. Leave at 0 for no inactive
            socket monitoring.
          minimum: 0
        socketMaxLifespan:
          type: number
          title: Socket max lifespan (seconds)
          description: The maximum duration a socket can remain open, even if active. This
            helps manage resources and mitigate issues caused by TCP pinning.
            Set to 0 to disable.
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Enable proxy protocol
          description: Enable if the connection is proxied by a device that supports proxy
            protocol v1 or v2
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        enableLoadBalancing:
          type: boolean
          title: Enable load balancing
          description: Load balance traffic across all Worker Processes
        authTokens:
          type: array
          title: Connected environment tokens
          description: Shared secrets to be used by connected environments to authorize
            connections. These tokens should be installed in Cribl TCP
            destinations in connected environments.
          items:
            $ref: "#/components/schemas/AuthTokenConfInputCriblTcp"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    InputCriblHttp:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - cribl_http
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        authTokens:
          type: array
          title: Connected environment tokens
          description: Shared secrets to be used by connected environments to authorize
            connections. These tokens should be installed in Cribl HTTP
            destinations in connected environments.
          items:
            $ref: "#/components/schemas/AuthTokenConfInputCriblTcp"
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    InputCriblLakeHttp:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - cribl_lake_http
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        authTokens:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            type: string
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        criblAPI:
          type: string
          title: Cribl HTTP event API
          description: Absolute path on which to listen for the Cribl HTTP API requests.
            Only _bulk (default /cribl/_bulk) is available. Use empty string to
            disable.
          pattern: ^/|^$
        elasticAPI:
          type: string
          title: Elasticsearch API endpoint (Bulk API)
          description: Absolute path on which to listen for the Elasticsearch API
            requests. Only _bulk (default /elastic/_bulk) is available. Use
            empty string to disable.
          pattern: ^/|^$
        splunkHecAPI:
          type: string
          title: Splunk HEC endpoint
          description: Absolute path on which listen for the Splunk HTTP Event Collector
            API requests. Use empty string to disable.
          pattern: ^/|^$
        splunkHecAcks:
          type: boolean
          title: Enable Splunk HEC acknowledgements
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        authTokensExt:
          type: array
          title: Auth tokens
          items:
            type: object
            required:
              - token
            properties:
              token:
                type: string
                title: Token
              description:
                type: string
              metadata:
                type: array
                title: Fields
                description: Fields to add to events referencing this token
                items:
                  $ref: "#/components/schemas/MetadataConfInputCollection"
              splunkHecMetadata:
                type: object
                properties:
                  enabled:
                    type: boolean
                    title: Splunk HEC
                  defaultDataset:
                    type: string
                  allowedIndexesAtToken:
                    type: array
                    minItems: 0
                    items:
                      type: string
                      minLength: 1
              elasticsearchMetadata:
                type: object
                properties:
                  enabled:
                    title: Elasticsearch
                    type: boolean
                  defaultDataset:
                    type: string
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_authTokens:
          type: string
          description: Binds 'authTokens' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'authTokens' at runtime.
        __template_criblAPI:
          type: string
          description: Binds 'criblAPI' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'criblAPI' at runtime.
        __template_elasticAPI:
          type: string
          description: Binds 'elasticAPI' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'elasticAPI' at runtime.
        __template_splunkHecAPI:
          type: string
          description: Binds 'splunkHecAPI' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'splunkHecAPI' at runtime.
    InputTcpjson:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - tcpjson
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        ipWhitelistRegex:
          type: string
          title: IP allowlist regex
          description: Regex matching IP addresses that are allowed to establish a
            connection
        maxActiveCxn:
          type: number
          title: Active connection limit
          description: Maximum number of active connections allowed per Worker Process.
            Use 0 for unlimited.
          minimum: 0
        socketIdleTimeout:
          type: number
          title: Socket idle timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. After this time, the connection will be
            closed. Leave at 0 for no inactive socket monitoring.
          minimum: 0
        socketEndingMaxWait:
          type: number
          title: Forced socket termination timeout (seconds)
          description: How long the server will wait after initiating a closure for a
            client to close its end of the connection. If the client doesn't
            close the connection within this time, the server will forcefully
            terminate the socket to prevent resource leaks and ensure efficient
            connection cleanup and system stability. Leave at 0 for no inactive
            socket monitoring.
          minimum: 0
        socketMaxLifespan:
          type: number
          title: Socket max lifespan (seconds)
          description: The maximum duration a socket can remain open, even if active. This
            helps manage resources and mitigate issues caused by TCP pinning.
            Set to 0 to disable.
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Enable proxy protocol
          description: Enable if the connection is proxied by a device that supports proxy
            protocol v1 or v2
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        enableLoadBalancing:
          type: boolean
          title: Enable load balancing
          description: Load balance traffic across all Worker Processes
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        description:
          type: string
          title: Description
        authToken:
          type: string
          title: Auth token
          description: Shared secret to be provided by any client (in authToken header
            field). If empty, unauthorized access is permitted.
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    InputSystemMetrics:
      type: object
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - system_metrics
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        interval:
          type: number
          minimum: 1
          title: Polling interval
          description: Time, in seconds, between consecutive metric collections. Default
            is 10 seconds.
        host:
          type: object
          properties:
            mode:
              $ref: "#/components/schemas/ModeOptionsHost"
            custom:
              type: object
              properties:
                system:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: Select the level of detail for system metrics
                      enum:
                        - basic
                        - all
                        - custom
                        - disabled
                      x-speakeasy-enum-descriptions:
                        - Basic
                        - All
                        - Custom
                        - Disabled
                      x-speakeasy-unknown-values: allow
                    processes:
                      type: boolean
                      title: Process metrics
                      description: Generate metrics for the numbers of processes in various states
                cpu:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: Select the level of detail for CPU metrics
                      enum:
                        - basic
                        - all
                        - custom
                        - disabled
                      x-speakeasy-enum-descriptions:
                        - Basic
                        - All
                        - Custom
                        - Disabled
                      x-speakeasy-unknown-values: allow
                    perCpu:
                      type: boolean
                      title: Per-CPU metrics
                      description: Generate metrics for each CPU
                    detail:
                      type: boolean
                      title: Detailed metrics
                      description: Generate metrics for all CPU states
                    time:
                      type: boolean
                      title: CPU time metrics
                      description: Generate raw, monotonic CPU time counters
                memory:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: Select the level of detail for memory metrics
                      enum:
                        - basic
                        - all
                        - custom
                        - disabled
                      x-speakeasy-enum-descriptions:
                        - Basic
                        - All
                        - Custom
                        - Disabled
                      x-speakeasy-unknown-values: allow
                    detail:
                      type: boolean
                      title: Detailed metrics
                      description: Generate metrics for all memory states
                network:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: Select the level of detail for network metrics
                      enum:
                        - basic
                        - all
                        - custom
                        - disabled
                      x-speakeasy-enum-descriptions:
                        - Basic
                        - All
                        - Custom
                        - Disabled
                      x-speakeasy-unknown-values: allow
                    detail:
                      type: boolean
                      title: Detailed metrics
                      description: Generate full network metrics
                    protocols:
                      type: boolean
                      title: Protocol metrics
                      description: Generate protocol metrics for ICMP, ICMPMsg, IP, TCP, UDP and
                        UDPLite
                    devices:
                      type: array
                      title: Interface filter
                      description: "Network interfaces to include/exclude. Examples: eth0, !lo. All
                        interfaces are included if this list is empty."
                      items:
                        type: string
                    perInterface:
                      type: boolean
                      title: Per-interface metrics
                      description: Generate separate metrics for each interface
                disk:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: Select the level of detail for disk metrics
                      enum:
                        - basic
                        - all
                        - custom
                        - disabled
                      x-speakeasy-enum-descriptions:
                        - Basic
                        - All
                        - Custom
                        - Disabled
                      x-speakeasy-unknown-values: allow
                    detail:
                      type: boolean
                      title: Detailed metrics
                      description: Generate full disk metrics
                    inodes:
                      type: boolean
                      title: Enable inode metrics
                      description: Generate filesystem inode metrics
                    devices:
                      type: array
                      title: Device filter
                      description: "Block devices to include/exclude. Examples: sda*, !loop*.
                        Wildcards and ! (not) operators are supported. All
                        devices are included if this list is empty."
                      items:
                        type: string
                    mountpoints:
                      type: array
                      title: Mountpoint filter
                      description: "Filesystem mountpoints to include/exclude. Examples: /, /home,
                        !/proc*, !/tmp. Wildcards and ! (not) operators are
                        supported. All mountpoints are included if this list is
                        empty."
                      items:
                        type: string
                    fstypes:
                      type: array
                      title: Filesystem type filter
                      description: "Filesystem types to include/exclude. Examples: ext4, !*tmpfs,
                        !squashfs. Wildcards and ! (not) operators are
                        supported. All types are included if this list is
                        empty."
                      items:
                        type: string
                    perDevice:
                      type: boolean
                      title: Per-device metrics
                      description: Generate separate metrics for each device
        process:
          $ref: "#/components/schemas/ProcessType"
        container:
          type: object
          properties:
            mode:
              type: string
              description: Select the level of detail for container metrics
              enum:
                - basic
                - all
                - custom
                - disabled
              x-speakeasy-enum-descriptions:
                - Basic
                - All
                - Custom
                - Disabled
              x-speakeasy-unknown-values: allow
            dockerSocket:
              type: array
              title: Docker socket
              description: Full paths for Docker's UNIX-domain socket
              items:
                type: string
            dockerTimeout:
              type: number
              minimum: 1
              title: Docker timeout
              description: Timeout, in seconds, for the Docker API
            filters:
              type: array
              title: Container filters
              description: Containers matching any of these will be included. All are included
                if no filters are added.
              items:
                type: object
                required:
                  - expr
                properties:
                  expr:
                    type: string
                    title: Expression
            allContainers:
              type: boolean
              title: All containers
              description: Include stopped and paused containers
            perDevice:
              type: boolean
              title: Per-device metrics
              description: Generate separate metrics for each device
            detail:
              type: boolean
              title: Detailed metrics
              description: Generate full container metrics
        gpu:
          $ref: "#/components/schemas/GpuType"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        persistence:
          type: object
          title: persistence
          properties:
            enable:
              type: boolean
              title: Enable disk spooling
              description: Spool metrics to disk for Cribl Edge and Search
            timeWindow:
              type: string
              title: Bucket time span
              description: Time span for each file bucket
            maxDataSize:
              type: string
              title: Data size limit
              description: "Maximum disk space allowed to be consumed (examples: 420MB, 4GB).
                When limit is reached, older data will be deleted."
              pattern: ^\d+\s*(?:\w{2})?$
            maxDataTime:
              title: Data age limit
              type: string
              description: "Maximum amount of time to retain data (examples: 2h, 4d). When
                limit is reached, older data will be deleted."
              pattern: \d+[smhd]$
            compress:
              $ref: "#/components/schemas/DataCompressionFormatOptionsPersistence"
            destPath:
              type: string
              title: Path location
              description: Path to use to write metrics. Defaults to
                $CRIBL_HOME/state/system_metrics
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    InputSystemState:
      type: object
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - system_state
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        interval:
          type: number
          minimum: 1
          title: Polling interval
          description: Time, in seconds, between consecutive state collections. Default is
            300 seconds (5 minutes).
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        collectors:
          type: object
          properties:
            hostsfile:
              type: object
              title: Hosts File
              description: Creates events based on entries collected from the hosts file
              properties:
                enable:
                  type: boolean
                  title: Enabled
            interfaces:
              type: object
              title: Interfaces
              description: Creates events for each of the host’s network interfaces
              properties:
                enable:
                  type: boolean
                  title: Enabled
            disk:
              type: object
              title: Disks & File Systems
              description: Creates events for physical disks, partitions, and file systems
              properties:
                enable:
                  type: boolean
                  title: Enabled
            metadata:
              type: object
              title: Host Info
              description: Creates events based on the host system’s current state
              properties:
                enable:
                  type: boolean
                  title: Enabled
            routes:
              type: object
              title: Routes
              description: Creates events based on entries collected from the host’s network
                routes
              properties:
                enable:
                  type: boolean
                  title: Enabled
            dns:
              type: object
              title: DNS
              description: Creates events for DNS resolvers and search entries
              properties:
                enable:
                  type: boolean
                  title: Enabled
            user:
              type: object
              title: Users & Groups
              description: Creates events for local users and groups
              properties:
                enable:
                  type: boolean
                  title: Enabled
            firewall:
              type: object
              title: Firewall
              description: Creates events for Firewall rules entries
              properties:
                enable:
                  type: boolean
                  title: Enabled
            services:
              type: object
              title: Services
              description: Creates events from the list of services
              properties:
                enable:
                  type: boolean
                  title: Enabled
            ports:
              type: object
              title: Listening Ports
              description: Creates events from list of listening ports
              properties:
                enable:
                  type: boolean
                  title: Enabled
            loginUsers:
              type: object
              title: Logged-In Users
              description: Creates events from list of logged-in users
              properties:
                enable:
                  type: boolean
                  title: Enabled
        persistence:
          type: object
          properties:
            enable:
              type: boolean
              title: Enable disk spooling
              description: Spool metrics to disk for Cribl Edge and Search
            timeWindow:
              type: string
              title: Bucket time span
              description: Time span for each file bucket
            maxDataSize:
              type: string
              title: Data size limit
              description: "Maximum disk space allowed to be consumed (examples: 420MB, 4GB).
                When limit is reached, older data will be deleted."
              pattern: ^\d+\s*(?:\w{2})?$
            maxDataTime:
              title: Data age limit
              type: string
              description: "Maximum amount of time to retain data (examples: 2h, 4d). When
                limit is reached, older data will be deleted."
              pattern: \d+[smhd]$
            compress:
              $ref: "#/components/schemas/DataCompressionFormatOptionsPersistence"
            destPath:
              type: string
              title: Path location
              description: Path to use to write metrics. Defaults to
                $CRIBL_HOME/state/system_state
        disableNativeModule:
          type: boolean
          title: Use Windows Tools
          description: Enable to use built-in tools (PowerShell) to collect events instead
            of native API (default) [Learn
            more](https://docs.cribl.io/edge/sources-system-state/#advanced-tab)
        disableNativeLastLogModule:
          type: boolean
          title: Use legacy collection for LastLog
          description: Enable only to collect LastLog data via legacy implementation. This
            option will be removed in a future release. Please contact Support
            before enabling. [Learn
            more](https://docs.cribl.io/edge/sources-system-state/#advanced-tab)
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    InputKubeMetrics:
      type: object
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - kube_metrics
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        interval:
          type: number
          minimum: 1
          title: Polling interval
          description: Time, in seconds, between consecutive metrics collections. Default
            is 15 secs.
        scrapeKubelet:
          type: boolean
          title: Collect kubelet metrics
          description: Enable to scrape kubelet metrics from
            https://<nodeIP>:10250/metrics. Requires Edge to run as a DaemonSet
            with direct network access to the node.
        scrapeCadvisor:
          type: boolean
          title: Collect cAdvisor metrics
          description: Scrape cAdvisor container metrics from
            https://<nodeIP>:10250/metrics/cadvisor. Requires Edge to run as a
            DaemonSet with direct network access to the Node.
        rules:
          type: array
          title: Filter Rules
          description: Add rules to decide which Kubernetes objects to generate metrics
            for. Events are generated if no rules are given or of all the rules'
            expressions evaluate to true.
          items:
            $ref: "#/components/schemas/RuleConfInputKubeMetrics"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        persistence:
          type: object
          title: persistence
          properties:
            enable:
              type: boolean
              title: Enable disk spooling
              description: Spool metrics on disk for Cribl Search
            timeWindow:
              type: string
              title: Bucket time span
              description: Time span for each file bucket
            maxDataSize:
              type: string
              title: Data size limit
              description: "Maximum disk space allowed to be consumed (examples: 420MB, 4GB).
                When limit is reached, older data will be deleted."
              pattern: ^\d+\s*(?:\w{2})?$
            maxDataTime:
              title: Data age limit
              type: string
              description: "Maximum amount of time to retain data (examples: 2h, 4d). When
                limit is reached, older data will be deleted."
              pattern: \d+[smhd]$
            compress:
              $ref: "#/components/schemas/DataCompressionFormatOptionsPersistence"
            destPath:
              type: string
              title: Path location
              description: Path to use to write metrics. Defaults to $CRIBL_HOME/state/<id>
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    InputKubeLogs:
      type: object
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - kube_logs
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        interval:
          type: number
          minimum: 1
          title: Polling interval
          description: Time, in seconds, between checks for new containers. Default is 15
            secs.
        rules:
          type: array
          title: Filter Rules
          description: Add rules to decide which Pods to collect logs from. Logs are
            collected if no rules are given or if all the rules' expressions
            evaluate to true.
          items:
            type: object
            required:
              - filter
            properties:
              filter:
                type: string
                title: Filter Expression
                description: JavaScript expression applied to Pod objects. Return 'true' to
                  include it.
              description:
                type: string
                title: Description
                description: Optional description of this rule's purpose
        timestamps:
          type: boolean
          title: Enable timestamps
          description: For use when containers do not emit a timestamp, prefix each line
            of output with a timestamp. If you enable this setting, you can use
            the Kubernetes Logs Event Breaker and the kubernetes_logs
            Pre-processing Pipeline to remove them from the events after the
            timestamps are extracted.
        lineBufferLimit:
          type: number
          minimum: 1024
          title: Line buffer limit
          description: Maximum bytes to buffer while reassembling a single log line. A
            line that exceeds this size is flushed as-is, either whole or
            partially. The default is 1048576 (1 MB).
        __LBDisableAssembly:
          type: boolean
          description: Internal flag to disable LB worker payload reassembly.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        persistence:
          $ref: "#/components/schemas/DiskSpoolingType"
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        enableLoadBalancing:
          type: boolean
          title: Enable load balancing
          description: Load balance traffic across all Worker Processes
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    InputKubeEvents:
      type: object
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - kube_events
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        rules:
          type: array
          title: Filter Rules
          description: Filtering on event fields
          items:
            $ref: "#/components/schemas/RuleConfInputKubeMetrics"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    InputWindowsMetrics:
      type: object
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - windows_metrics
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        interval:
          type: number
          minimum: 1
          title: Polling interval
          description: Time, in seconds, between consecutive metric collections. Default
            is 10 seconds.
        host:
          type: object
          properties:
            mode:
              $ref: "#/components/schemas/ModeOptionsHost"
            custom:
              type: object
              properties:
                system:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: Select the level of details for system metrics
                      enum:
                        - basic
                        - all
                        - custom
                        - disabled
                      x-speakeasy-enum-descriptions:
                        - Basic
                        - All
                        - Custom
                        - Disabled
                      x-speakeasy-unknown-values: allow
                    detail:
                      type: boolean
                      title: Detailed metrics
                      description: Generate metrics for all system information
                cpu:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: Select the level of details for CPU metrics
                      enum:
                        - basic
                        - all
                        - custom
                        - disabled
                      x-speakeasy-enum-descriptions:
                        - Basic
                        - All
                        - Custom
                        - Disabled
                      x-speakeasy-unknown-values: allow
                    perCpu:
                      type: boolean
                      title: Per-CPU metrics
                      description: Generate metrics for each CPU
                    detail:
                      type: boolean
                      title: Detailed metrics
                      description: Generate metrics for all CPU states
                    time:
                      type: boolean
                      title: CPU time metrics
                      description: Generate raw, monotonic CPU time counters
                memory:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: Select the level of details for memory metrics
                      enum:
                        - basic
                        - all
                        - custom
                        - disabled
                      x-speakeasy-enum-descriptions:
                        - Basic
                        - All
                        - Custom
                        - Disabled
                      x-speakeasy-unknown-values: allow
                    detail:
                      type: boolean
                      title: Detailed metrics
                      description: Generate metrics for all memory states
                network:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: Select the level of details for network metrics
                      enum:
                        - basic
                        - all
                        - custom
                        - disabled
                      x-speakeasy-enum-descriptions:
                        - Basic
                        - All
                        - Custom
                        - Disabled
                      x-speakeasy-unknown-values: allow
                    detail:
                      type: boolean
                      title: Detailed metrics
                      description: Generate full network metrics
                    protocols:
                      type: boolean
                      title: Protocol metrics
                      description: Generate protocol metrics for ICMP, ICMPMsg, IP, TCP, UDP and
                        UDPLite
                    devices:
                      type: array
                      title: Interface filter
                      description: Network interfaces to include/exclude. All interfaces are included
                        if this list is empty.
                      items:
                        type: string
                    perInterface:
                      type: boolean
                      title: Per interface metrics
                      description: Generate separate metrics for each interface
                disk:
                  type: object
                  properties:
                    mode:
                      type: string
                      description: Select the level of details for disk metrics
                      enum:
                        - basic
                        - all
                        - custom
                        - disabled
                      x-speakeasy-enum-descriptions:
                        - Basic
                        - All
                        - Custom
                        - Disabled
                      x-speakeasy-unknown-values: allow
                    perVolume:
                      type: boolean
                      title: Per volume metrics
                      description: Generate separate metrics for each volume
                    detail:
                      type: boolean
                      title: Detailed metrics
                      description: Generate full disk metrics
                    volumes:
                      type: array
                      title: Volume filter
                      description: "Windows volumes to include/exclude. E.g.: C:, !E:, etc. Wildcards
                        and ! (not) operators are supported. All volumes are
                        included if this list is empty."
                      items:
                        type: string
        process:
          $ref: "#/components/schemas/ProcessType"
        gpu:
          $ref: "#/components/schemas/GpuType"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        persistence:
          type: object
          title: persistence
          properties:
            enable:
              type: boolean
              title: Enable disk spooling
              description: Spool metrics to disk for Cribl Edge and Search
            timeWindow:
              type: string
              title: Bucket time span
              description: Time span for each file bucket
            maxDataSize:
              type: string
              title: Data size limit
              description: "Maximum disk space allowed to be consumed (examples: 420MB, 4GB).
                When limit is reached, older data will be deleted."
              pattern: ^\d+\s*(?:\w{2})?$
            maxDataTime:
              title: Data age limit
              type: string
              description: "Maximum amount of time to retain data (examples: 2h, 4d). When
                limit is reached, older data will be deleted."
              pattern: \d+[smhd]$
            compress:
              $ref: "#/components/schemas/DataCompressionFormatOptionsPersistence"
            destPath:
              type: string
              title: Path location
              description: Path to use to write metrics. Defaults to
                $CRIBL_HOME/state/windows_metrics
        disableNativeModule:
          type: boolean
          title: Use Windows Tools
          description: Enable to use built-in tools (PowerShell) to collect metrics
            instead of native API (default) [Learn
            more](https://docs.cribl.io/edge/sources-windows-metrics/#advanced-tab)
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    InputCrowdstrike:
      type: object
      required:
        - type
        - queueName
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - crowdstrike
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        queueName:
          type: string
          title: Queue
          description: "The name, URL, or ARN of the SQS queue to read notifications from.
            When a non-AWS URL is specified, format must be:
            '{url}/myQueueName'. Example: 'https://host:port/myQueueName'. Value
            must be a JavaScript expression (which can evaluate to a constant
            value), enclosed in quotes or backticks. Can be evaluated only at
            init time. Example referencing a Global Variable:
            `https://host:port/myQueue-${C.vars.myVar}`."
        fileFilter:
          type: string
          title: Filename filter
          description: "Regex matching file names to download and process. Defaults to: .*"
        awsAccountId:
          title: AWS account ID
          description: SQS queue owner's AWS account ID. Leave empty if SQS queue is in
            same AWS account.
          type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: AWS Region where the S3 bucket and SQS queue are located. Required,
            unless the Queue entry is a URL or ARN that includes a Region.
        endpoint:
          type: string
          title: Endpoint
          description: S3 service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to S3-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        maxMessages:
          type: number
          title: Message limit
          description: "The maximum number of messages SQS should return in a poll
            request. Amazon SQS never returns more messages than this value
            (however, fewer messages might be returned). Valid values: 1 to 10."
          minimum: 1
          maximum: 10
        visibilityTimeout:
          type: number
          title: Visibility timeout seconds
          description: After messages are retrieved by a ReceiveMessage request,
            @{product} will hide them from subsequent retrieve requests for at
            least this duration. You can set this as high as 43200 sec. (12
            hours).
          minimum: 0
          maximum: 43200
        numReceivers:
          type: number
          title: Number of receivers
          description: How many receiver processes to run. The higher the number, the
            better the throughput - at the expense of CPU overhead.
          minimum: 1
          maximum: 100
        socketTimeout:
          type: number
          title: Socket timeout
          description: Socket inactivity timeout (in seconds). Increase this value if
            timeouts occur due to backpressure.
          minimum: 1
          maximum: 43200
        skipOnError:
          type: boolean
          title: Skip file on error
          description: Skip files that trigger a processing error. Disabled by default,
            which allows retries after processing errors.
        includeSqsMetadata:
          type: boolean
          title: Include notification metadata
          description: Attach SQS notification metadata to a __sqsMetadata field on each
            event
        enableAssumeRole:
          type: boolean
          title: Enable for Amazon S3
          description: Use Assume Role credentials to access Amazon S3
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        enableSQSAssumeRole:
          type: boolean
          title: Enable for Amazon SQS
          description: Use Assume Role credentials when accessing Amazon SQS
        preprocess:
          $ref: "#/components/schemas/PreprocessType"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        checkpointing:
          $ref: "#/components/schemas/CheckpointingType"
        pollTimeout:
          type: number
          title: Poll timeout (secs)
          description: How long to wait for events before trying polling again. The lower
            the number the higher the AWS bill. The higher the number the longer
            it will take for the source to react to configuration changes and
            system restarts.
          minimum: 1
          maximum: 20
        encoding:
          type: string
          title: Encoding
          description: Character encoding to use when parsing ingested data. When not set,
            @{product} will default to UTF-8 but may incorrectly interpret
            multi-byte characters.
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        tagAfterProcessing:
          $ref: "#/components/schemas/TagAfterProcessingOptions"
        processedTagKey:
          type: string
          title: Tag key
          description: The key for the S3 object tag applied after processing. This field
            accepts an expression for dynamic generation.
        processedTagValue:
          type: string
          title: Tag value
          description: The value for the S3 object tag applied after processing. This
            field accepts an expression for dynamic generation.
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_queueName:
          type: string
          description: Binds 'queueName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'queueName' at runtime.
        __template_awsAccountId:
          type: string
          description: Binds 'awsAccountId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsAccountId' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    InputDatadogAgent:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - datadog_agent
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        extractMetrics:
          type: boolean
          title: Extract metrics
          description: Toggle to Yes to extract each incoming metric to multiple events,
            one per data point. This works well when sending metrics to a
            statsd-type output. If sending metrics to DatadogHQ or any
            destination that accepts arbitrary JSON, leave toggled to No (the
            default).
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        proxyMode:
          type: object
          title: ""
          required:
            - enabled
          properties:
            enabled:
              type: boolean
              title: Forward API key validation requests
              description: Toggle to Yes to send key validation requests from Datadog Agent to
                the Datadog API. If toggled to No (the default), Stream handles
                key validation requests by always responding that the key is
                valid.
            rejectUnauthorized:
              type: boolean
              title: Reject unauthorized certificates
              description: Whether to reject certificates that cannot be verified against a
                valid CA (e.g., self-signed certificates).
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    InputDatagen:
      type: object
      required:
        - type
        - samples
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - datagen
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        samples:
          title: Datagens
          type: array
          minItems: 1
          items:
            type: object
            required:
              - sample
              - eventsPerSec
            properties:
              sample:
                type: string
                title: Data Generator File Name
              eventsPerSec:
                type: number
                title: Events Per Second Per Worker Node
                description: Maximum number of events to generate per second per Worker Node.
                  Defaults to 10.
                minimum: 1
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    InputHttpRaw:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - http_raw
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        authTokens:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            type: string
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        allowedPaths:
          type: array
          title: Allowed URI paths
          description: List of URI paths accepted by this input, wildcards are supported,
            e.g /api/v*/hook. Defaults to allow all.
          items:
            type: string
            minLength: 1
        allowedMethods:
          type: array
          title: Allowed HTTP methods
          description: List of HTTP methods accepted by this input. Wildcards are
            supported (such as P*, GET). Defaults to allow all.
          items:
            type: string
            minLength: 1
        authTokensExt:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            $ref: "#/components/schemas/AuthTokensExtConfInputHttp"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_authTokens:
          type: string
          description: Binds 'authTokens' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'authTokens' at runtime.
        __template_allowedPaths:
          type: string
          description: Binds 'allowedPaths' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'allowedPaths' at runtime.
    InputKinesis:
      type: object
      required:
        - type
        - streamName
        - region
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - kinesis
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        streamName:
          type: string
          title: Stream name
          description: Kinesis Data Stream to read data from
        serviceInterval:
          type: number
          title: Service period
          description: Time interval in minutes between consecutive service calls
          minimum: 1
          maximum: 5
        shardExpr:
          type: string
          title: Shard selection expression
          description: A JavaScript expression to be called with each shardId for the
            stream. If the expression evaluates to a truthy value, the shard
            will be processed.
        shardIteratorType:
          type: string
          title: Shard iterator start
          description: Location at which to start reading a shard for the first time
          enum:
            - TRIM_HORIZON
            - LATEST
          x-speakeasy-enum-descriptions:
            - Earliest record
            - Latest record
          x-speakeasy-unknown-values: allow
        payloadFormat:
          type: string
          title: Record data format
          description: Format of data inside the Kinesis Stream records. Gzip compression
            is automatically detected.
          enum:
            - cribl
            - ndjson
            - cloudwatch
            - line
          x-speakeasy-enum-descriptions:
            - Cribl
            - Newline JSON
            - Cloudwatch Logs
            - Event per line
          x-speakeasy-unknown-values: allow
        getRecordsLimit:
          type: number
          title: Records limit per call
          description: Maximum number of records per getRecords call
          minimum: 5000
          maximum: 10000
        getRecordsLimitTotal:
          type: number
          title: Total records limit
          description: Maximum number of records, across all shards, to pull down at once
            per Worker Process
          minimum: 20000
        loadBalancingAlgorithm:
          type: string
          title: Shard load balancing
          description: The load-balancing algorithm to use for spreading out shards across
            Workers and Worker Processes
          enum:
            - ConsistentHashing
            - RoundRobin
          x-speakeasy-enum-descriptions:
            - Consistent Hashing
            - Round Robin
          x-speakeasy-unknown-values: allow
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: Region where the Kinesis stream is located
        endpoint:
          type: string
          title: Endpoint
          description: Kinesis stream service endpoint. If empty, defaults to the AWS
            Region-specific endpoint. Otherwise, it must point to Kinesis
            stream-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        enableAssumeRole:
          type: boolean
          title: Enable for Kinesis stream
          description: Use Assume Role credentials to access Kinesis stream
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        verifyKPLCheckSums:
          type: boolean
          title: Verify KPL checksums
          description: Verify Kinesis Producer Library (KPL) event checksums
        avoidDuplicates:
          type: boolean
          title: Avoid duplicate records
          description: When resuming streaming from a stored state, Stream will read the
            next available record, rather than rereading the last-read record.
            Enabling this setting can cause data loss after a Worker Node's
            unexpected shutdown or restart.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_streamName:
          type: string
          description: Binds 'streamName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamName' at runtime.
        __template_shardIteratorType:
          type: string
          description: Binds 'shardIteratorType' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'shardIteratorType' at runtime.
        __template_payloadFormat:
          type: string
          description: Binds 'payloadFormat' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'payloadFormat' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    InputCriblmetrics:
      type: object
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - criblmetrics
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        prefix:
          type: string
          title: Metric name prefix
          description: A prefix that is applied to the metrics provided by Cribl Stream
        fullFidelity:
          type: boolean
          title: Full fidelity
          description: "Include granular metrics. Disabling this will drop the following
            metrics events:
            `cribl.logstream.host.(in_bytes,in_events,out_bytes,out_events)`,
            `cribl.logstream.index.(in_bytes,in_events,out_bytes,out_events)`,
            `cribl.logstream.source.(in_bytes,in_events,out_bytes,out_events)`,
            `cribl.logstream.sourcetype.(in_bytes,in_events,out_bytes,out_event\
            s)`."
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    InputMetrics:
      type: object
      required:
        - type
        - host
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - metrics
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. For IPv4 (all addresses), use the default
            '0.0.0.0'. For IPv6, enter '::' (all addresses) or specify an IP
            address.
        udpPort:
          type: number
          title: UDP Port
          maximum: 65535
          description: Enter UDP port number to listen on. Not required if listening on TCP.
        tcpPort:
          type: number
          title: TCP Port
          maximum: 65535
          description: Enter TCP port number to listen on. Not required if listening on UDP.
        maxBufferSize:
          type: number
          title: Buffer size limit (events)
          description: Maximum number of events to buffer when downstream is blocking.
            Only applies to UDP.
          minimum: 0
        ipWhitelistRegex:
          type: string
          title: IP allowlist regex
          description: Regex matching IP addresses that are allowed to send data
        enableProxyHeader:
          type: boolean
          title: Enable proxy protocol
          description: Enable if the connection is proxied by a device that supports Proxy
            Protocol V1 or V2
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        udpSocketRxBufSize:
          type: number
          title: UDP socket buffer size (bytes)
          description: "Optionally, set the SO_RCVBUF socket option for the UDP socket.
            This value tells the operating system how many bytes can be buffered
            in the kernel before events are dropped. Leave blank to use the OS
            default. Caution: Increasing this value will affect OS memory
            utilization."
          minimum: 256
          maximum: 4294967295
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_udpPort:
          type: string
          description: Binds 'udpPort' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'udpPort' at runtime.
        __template_tcpPort:
          type: string
          description: Binds 'tcpPort' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tcpPort' at runtime.
    InputS3:
      type: object
      required:
        - type
        - queueName
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - s3
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        queueName:
          type: string
          title: Queue
          description: "The name, URL, or ARN of the SQS queue to read notifications from.
            When a non-AWS URL is specified, format must be:
            '{url}/myQueueName'. Example: 'https://host:port/myQueueName'. Value
            must be a JavaScript expression (which can evaluate to a constant
            value), enclosed in quotes or backticks. Can be evaluated only at
            init time. Example referencing a Global Variable:
            `https://host:port/myQueue-${C.vars.myVar}`."
        fileFilter:
          type: string
          title: Filename filter
          description: "Regex matching file names to download and process. Defaults to: .*"
        awsAccountId:
          title: AWS account ID
          description: SQS queue owner's AWS account ID. Leave empty if SQS queue is in
            same AWS account.
          type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: AWS Region where the S3 bucket and SQS queue are located. Required,
            unless the Queue entry is a URL or ARN that includes a Region.
        endpoint:
          type: string
          title: Endpoint
          description: S3 service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to S3-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        maxMessages:
          type: number
          title: Message limit
          description: "The maximum number of messages SQS should return in a poll
            request. Amazon SQS never returns more messages than this value
            (however, fewer messages might be returned). Valid values: 1 to 10."
          minimum: 1
          maximum: 10
        visibilityTimeout:
          type: number
          title: Visibility timeout seconds
          description: After messages are retrieved by a ReceiveMessage request,
            @{product} will hide them from subsequent retrieve requests for at
            least this duration. You can set this as high as 43200 sec. (12
            hours).
          minimum: 0
          maximum: 43200
        numReceivers:
          type: number
          title: Number of receivers
          description: How many receiver processes to run. The higher the number, the
            better the throughput - at the expense of CPU overhead.
          minimum: 1
          maximum: 100
        socketTimeout:
          type: number
          title: Socket timeout
          description: Socket inactivity timeout (in seconds). Increase this value if
            timeouts occur due to backpressure.
          minimum: 1
          maximum: 43200
        skipOnError:
          type: boolean
          title: Skip file on error
          description: Skip files that trigger a processing error. Disabled by default,
            which allows retries after processing errors.
        includeSqsMetadata:
          type: boolean
          title: Include notification metadata
          description: Attach SQS notification metadata to a __sqsMetadata field on each
            event
        enableAssumeRole:
          type: boolean
          title: Enable for Amazon S3
          description: Use Assume Role credentials to access Amazon S3
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        enableSQSAssumeRole:
          type: boolean
          title: Enable for Amazon SQS
          description: Use Assume Role credentials when accessing Amazon SQS
        preprocess:
          $ref: "#/components/schemas/PreprocessType"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        parquetChunkSizeMB:
          type: number
          title: Parquet chunk size limit (MB)
          description: Maximum file size for each Parquet chunk
          maximum: 100
          minimum: 1
        parquetChunkDownloadTimeout:
          type: number
          title: Parquet chunk download timeout (seconds)
          description: The maximum time allowed for downloading a Parquet chunk.
            Processing will stop if a chunk cannot be downloaded within the time
            specified.
          maximum: 3600
          minimum: 1
        checkpointing:
          $ref: "#/components/schemas/CheckpointingType"
        pollTimeout:
          type: number
          title: Poll timeout (secs)
          description: How long to wait for events before trying polling again. The lower
            the number the higher the AWS bill. The higher the number the longer
            it will take for the source to react to configuration changes and
            system restarts.
          minimum: 1
          maximum: 20
        encoding:
          type: string
          title: Encoding
          description: Character encoding to use when parsing ingested data. When not set,
            @{product} will default to UTF-8 but may incorrectly interpret
            multi-byte characters.
        tagAfterProcessing:
          type: boolean
          title: Tag after processing
          description: Add a tag to processed S3 objects. Requires s3:GetObjectTagging and
            s3:PutObjectTagging AWS permissions.
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        processedTagKey:
          type: string
          title: Tag key
          description: The key for the S3 object tag applied after processing. This field
            accepts an expression for dynamic generation.
        processedTagValue:
          type: string
          title: Tag value
          description: The value for the S3 object tag applied after processing. This
            field accepts an expression for dynamic generation.
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_queueName:
          type: string
          description: Binds 'queueName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'queueName' at runtime.
        __template_awsAccountId:
          type: string
          description: Binds 'awsAccountId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsAccountId' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    InputS3Inventory:
      type: object
      required:
        - type
        - queueName
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - s3_inventory
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        queueName:
          type: string
          title: Queue
          description: "The name, URL, or ARN of the SQS queue to read notifications from.
            When a non-AWS URL is specified, format must be:
            '{url}/myQueueName'. Example: 'https://host:port/myQueueName'. Value
            must be a JavaScript expression (which can evaluate to a constant
            value), enclosed in quotes or backticks. Can be evaluated only at
            init time. Example referencing a Global Variable:
            `https://host:port/myQueue-${C.vars.myVar}`."
        fileFilter:
          type: string
          title: Filename filter
          description: "Regex matching file names to download and process. Defaults to: .*"
        awsAccountId:
          title: AWS account ID
          description: SQS queue owner's AWS account ID. Leave empty if SQS queue is in
            same AWS account.
          type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: AWS Region where the S3 bucket and SQS queue are located. Required,
            unless the Queue entry is a URL or ARN that includes a Region.
        endpoint:
          type: string
          title: Endpoint
          description: S3 service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to S3-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        maxMessages:
          type: number
          title: Message limit
          description: "The maximum number of messages SQS should return in a poll
            request. Amazon SQS never returns more messages than this value
            (however, fewer messages might be returned). Valid values: 1 to 10."
          minimum: 1
          maximum: 10
        visibilityTimeout:
          type: number
          title: Visibility timeout seconds
          description: After messages are retrieved by a ReceiveMessage request,
            @{product} will hide them from subsequent retrieve requests for at
            least this duration. You can set this as high as 43200 sec. (12
            hours).
          minimum: 0
          maximum: 43200
        numReceivers:
          type: number
          title: Number of receivers
          description: How many receiver processes to run. The higher the number, the
            better the throughput - at the expense of CPU overhead.
          minimum: 1
          maximum: 100
        socketTimeout:
          type: number
          title: Socket timeout
          description: Socket inactivity timeout (in seconds). Increase this value if
            timeouts occur due to backpressure.
          minimum: 1
          maximum: 43200
        skipOnError:
          type: boolean
          title: Skip file on error
          description: Skip files that trigger a processing error. Disabled by default,
            which allows retries after processing errors.
        includeSqsMetadata:
          type: boolean
          title: Include notification metadata
          description: Attach SQS notification metadata to a __sqsMetadata field on each
            event
        enableAssumeRole:
          type: boolean
          title: Enable for Amazon S3
          description: Use Assume Role credentials to access Amazon S3
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        enableSQSAssumeRole:
          type: boolean
          title: Enable for Amazon SQS
          description: Use Assume Role credentials when accessing Amazon SQS
        preprocess:
          $ref: "#/components/schemas/PreprocessType"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        parquetChunkSizeMB:
          type: number
          title: Parquet chunk size limit (MB)
          description: Maximum file size for each Parquet chunk
          maximum: 100
          minimum: 1
        parquetChunkDownloadTimeout:
          type: number
          title: Parquet chunk download timeout (seconds)
          description: The maximum time allowed for downloading a Parquet chunk.
            Processing will stop if a chunk cannot be downloaded within the time
            specified.
          maximum: 3600
          minimum: 1
        checkpointing:
          $ref: "#/components/schemas/CheckpointingType"
        pollTimeout:
          type: number
          title: Poll timeout (secs)
          description: How long to wait for events before trying polling again. The lower
            the number the higher the AWS bill. The higher the number the longer
            it will take for the source to react to configuration changes and
            system restarts.
          minimum: 1
          maximum: 20
        checksumSuffix:
          type: string
          title: Checksum Suffix
          description: Filename suffix of the manifest checksum file. If a filename
            matching this suffix is received        in the queue, the matching
            manifest file will be downloaded and validated against its value.
            Defaults to "checksum"
        maxManifestSizeKB:
          type: integer
          title: Manifest size limit (KB)
          description: Maximum download size (KB) of each manifest or checksum file.
            Manifest files larger than this size will not be
            read.        Defaults to 4096.
          minimum: 1
        validateInventoryFiles:
          type: boolean
          title: Validate inventory files
          description: If set to Yes, each inventory file in the manifest will be
            validated against its checksum. Defaults to false
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        tagAfterProcessing:
          $ref: "#/components/schemas/TagAfterProcessingOptions"
        processedTagKey:
          type: string
          title: Tag key
          description: The key for the S3 object tag applied after processing. This field
            accepts an expression for dynamic generation.
        processedTagValue:
          type: string
          title: Tag value
          description: The value for the S3 object tag applied after processing. This
            field accepts an expression for dynamic generation.
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_queueName:
          type: string
          description: Binds 'queueName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'queueName' at runtime.
        __template_awsAccountId:
          type: string
          description: Binds 'awsAccountId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsAccountId' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    InputSnmp:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - snmp
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. For IPv4 (all addresses), use the default
            '0.0.0.0'. For IPv6, enter '::' (all addresses) or specify an IP
            address.
        port:
          type: number
          title: UDP port
          maximum: 65535
          description: UDP port to receive SNMP traps on. Defaults to 162.
        snmpV3Auth:
          type: object
          title: SNMPv3 authentication
          description: Authentication parameters for SNMPv3 trap. Set the log level to
            debug if you are experiencing authentication or decryption issues.
          required:
            - v3AuthEnabled
          properties:
            v3AuthEnabled:
              type: boolean
              title: Enabled
            allowUnmatchedTrap:
              type: boolean
              title: Allow unmatched traps
              description: Pass through traps that don't match any of the configured users.
                @{product} will not attempt to decrypt these traps.
            v3Users:
              type: array
              title: SNMP v3 users
              description: User credentials for receiving v3 traps
              minItems: 1
              items:
                type: object
                required:
                  - name
                properties:
                  name:
                    title: V3 name
                    type: string
                    minLength: 1
                  authProtocol:
                    $ref: "#/components/schemas/AuthenticationProtocolOptionsV3User"
                  authKey:
                    type: string
                    title: V3 authentication key
                  privProtocol:
                    $ref: "#/components/schemas/PrivacyProtocolOptionsSnmpTrapSerializeV3UserAuthPr\
                      otocolNotNone"
                  privKey:
                    type: string
                    title: V3 privacy key
        maxBufferSize:
          type: number
          title: Buffer size limit (events)
          description: Maximum number of events to buffer when downstream is blocking.
          minimum: 0
        ipWhitelistRegex:
          type: string
          title: IP allowlist regex
          description: Regex matching IP addresses that are allowed to send data
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        udpSocketRxBufSize:
          type: number
          title: UDP socket buffer size (bytes)
          description: "Optionally, set the SO_RCVBUF socket option for the UDP socket.
            This value tells the operating system how many bytes can be buffered
            in the kernel before events are dropped. Leave blank to use the OS
            default. Caution: Increasing this value will affect OS memory
            utilization."
          minimum: 256
          maximum: 4294967295
        varbindsWithTypes:
          type: boolean
          title: Include varbind types
          description: If enabled, parses varbinds as an array of objects that include
            OID, value, and type
        bestEffortParsing:
          type: boolean
          title: Best effort parsing
          description: If enabled, the parser will attempt to parse varbind octet strings
            as UTF-8, first, otherwise will fallback to other methods
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    InputOpenTelemetry:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - open_telemetry
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            sec.; maximum 600 sec. (10 min.).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Enable to expose the /cribl_health endpoint, which returns 200 OK
            when this Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist.
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        protocol:
          type: string
          title: Protocol
          description: Select whether to leverage gRPC or HTTP for OpenTelemetry
          enum:
            - grpc
            - http
          x-speakeasy-enum-descriptions:
            - gRPC
            - HTTP
          x-speakeasy-unknown-values: allow
        extractSpans:
          type: boolean
          title: Extract spans
          description: Enable to extract each incoming span to a separate event
        extractMetrics:
          type: boolean
          title: Extract metrics
          description: Enable to extract each incoming Gauge or IntGauge metric to
            multiple events, one per data point
        otlpVersion:
          type: string
          title: OTLP version
          description: The version of OTLP Protobuf definitions to use when interpreting
            received data
          enum:
            - 0.10.0
            - 1.3.1
          x-speakeasy-enum-descriptions:
            - 0.10.0
            - 1.3.1
          x-speakeasy-unknown-values: allow
        authType:
          type: string
          title: Authentication type
          description: OpenTelemetry authentication type
          enum:
            - none
            - basic
            - credentialsSecret
            - token
            - textSecret
          x-speakeasy-enum-descriptions:
            - None
            - Basic
            - Basic (credentials secret)
            - Token
            - Token (text secret)
          x-speakeasy-unknown-values: allow
        authMethodsExt:
          type: array
          title: Auth methods
          description: Shared secrets to authenticate clients. Supports Bearer tokens and
            Basic auth. If empty, unauthenticated access is permitted.
          minItems: 0
          items:
            type: object
            required:
              - authType
            properties:
              authType:
                type: string
                title: Authentication type
                enum:
                  - token
                  - tokenSecret
                  - basic
                  - basicSecret
                x-speakeasy-enum-descriptions:
                  - Token
                  - Token (secret)
                  - Basic
                  - Basic (credentials secret)
                x-speakeasy-unknown-values: allow
              token:
                type: string
                minLength: 1
                pattern: .*\S.*
                title: Token
                description: Bearer token for Authorization header
              description:
                type: string
                title: Description
              metadata:
                type: array
                title: Fields
                description: Fields to add to events referencing this auth method
                items:
                  $ref: "#/components/schemas/MetadataConfInputCollection"
              enabled:
                type: boolean
                title: Enable
              tokenSecret:
                type: string
                title: Token secret (text secret)
                description: Select or create a stored text secret
                minLength: 1
              username:
                type: string
                minLength: 1
                pattern: .*\S.*
                title: Username
              password:
                type: string
                minLength: 1
                pattern: .*\S.*
                title: Password
              credentialsSecret:
                type: string
                title: Credentials secret
                description: Select or create a secret that references your credentials
                minLength: 1
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        maxActiveCxn:
          type: number
          title: Active connection limit
          description: Maximum number of active connections allowed per Worker Process.
            Use 0 for unlimited.
          minimum: 0
        description:
          type: string
          title: Description
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        token:
          type: string
          title: Token
          description: Bearer token to include in the authorization header
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        textSecret:
          type: string
          title: Token (text secret)
          description: Select or create a stored text secret
        extractLogs:
          type: boolean
          title: Extract logs
          description: Enable to extract each incoming log record to a separate event
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_protocol:
          type: string
          description: Binds 'protocol' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'protocol' at runtime.
        __template_otlpVersion:
          type: string
          description: Binds 'otlpVersion' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'otlpVersion' at runtime.
    InputModelDrivenTelemetry:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - model_driven_telemetry
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        maxActiveCxn:
          type: number
          title: Active connection limit
          description: Maximum number of active connections allowed per Worker Process.
            Use 0 for unlimited.
          minimum: 0
        shutdownTimeoutMs:
          type: number
          title: Shutdown timeout
          description: Time in milliseconds to allow the server to shutdown gracefully
            before forcing shutdown. Defaults to 5000.
          minimum: 1
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    InputSqs:
      type: object
      required:
        - type
        - queueName
        - queueType
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - sqs
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        queueName:
          type: string
          title: Queue
          description: "The name, URL, or ARN of the SQS queue to read events from. When a
            non-AWS URL is specified, format must be: '{url}/myQueueName'.
            Example: 'https://host:port/myQueueName'. Value must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can only be evaluated at init time. Example
            referencing a Global Variable:
            `https://host:port/myQueue-${C.vars.myVar}`."
        queueType:
          title: Queue type
          type: string
          description: The queue type used (or created)
          enum:
            - standard
            - fifo
          x-speakeasy-enum-descriptions:
            - Standard
            - FIFO
          x-speakeasy-unknown-values: allow
        awsAccountId:
          title: AWS account ID
          description: SQS queue owner's AWS account ID. Leave empty if SQS queue is in
            same AWS account.
          type: string
        createQueue:
          type: boolean
          title: Create queue
          description: Create queue if it does not exist
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: AWS Region where the SQS queue is located. Required, unless the
            Queue entry is a URL or ARN that includes a Region.
        endpoint:
          type: string
          title: Endpoint
          description: SQS service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to SQS-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        enableAssumeRole:
          type: boolean
          title: Enable for SQS
          description: Use Assume Role credentials to access SQS
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        maxMessages:
          type: number
          title: Message limit
          description: "The maximum number of messages SQS should return in a poll
            request. Amazon SQS never returns more messages than this value
            (however, fewer messages might be returned). Valid values: 1 to 10."
          minimum: 1
          maximum: 10
        visibilityTimeout:
          type: number
          title: Visibility Timeout Seconds
          description: After messages are retrieved by a ReceiveMessage request,
            @{product} will hide them from subsequent retrieve requests for at
            least this duration. You can set this as high as 43200 sec. (12
            hours).
          minimum: 0
          maximum: 43200
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        pollTimeout:
          type: number
          title: Poll timeout (secs)
          description: How long to wait for events before trying polling again. The lower
            the number the higher the AWS bill. The higher the number the longer
            it will take for the source to react to configuration changes and
            system restarts.
          minimum: 1
          maximum: 20
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        numReceivers:
          type: number
          title: Number of receivers
          description: How many receiver processes to run. The higher the number, the
            better the throughput - at the expense of CPU overhead.
          minimum: 1
          maximum: 100
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_queueName:
          type: string
          description: Binds 'queueName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'queueName' at runtime.
        __template_queueType:
          type: string
          description: Binds 'queueType' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'queueType' at runtime.
        __template_awsAccountId:
          type: string
          description: Binds 'awsAccountId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsAccountId' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    InputSyslog:
      type: object
      required:
        - type
        - host
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - syslog
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. For IPv4 (all addresses), use the default
            '0.0.0.0'. For IPv6, enter '::' (all addresses) or specify an IP
            address.
        udpPort:
          type: number
          title: UDP port
          maximum: 65535
          description: Enter UDP port number to listen on. Not required if listening on TCP.
        tcpPort:
          type: number
          title: TCP port
          maximum: 65535
          description: Enter TCP port number to listen on. Not required if listening on UDP.
        maxBufferSize:
          type: number
          title: Buffer size limit (events)
          description: Maximum number of events to buffer when downstream is blocking.
            Only applies to UDP.
          minimum: 0
        ipWhitelistRegex:
          type: string
          title: IP allowlist regex
          description: Regex matching IP addresses that are allowed to send data
        timestampTimezone:
          type: string
          title: Default timezone
          description: Timezone to assign to timestamps without timezone info
        singleMsgUdpPackets:
          type: boolean
          title: Single msg per UDP
          description: Treat UDP packet data received as full syslog message
        enableProxyHeader:
          type: boolean
          title: Enable proxy protocol
          description: Enable if the connection is proxied by a device that supports Proxy
            Protocol V1 or V2
        keepFieldsList:
          type: array
          title: Fields to keep
          description: Wildcard list of fields to keep from source data; * = ALL (default)
          minItems: 0
          items:
            type: string
        octetCounting:
          type: boolean
          title: Octet count framing
          description: Enable if incoming messages use octet counting per RFC 6587.
        inferFraming:
          type: boolean
          title: Infer Syslog framing
          description: Enable if we should infer the syslog framing of the incoming
            messages.
        strictlyInferOctetCounting:
          type: boolean
          title: Strictly infer octet count framing
          description: Enable if we should infer octet counting only if the messages
            comply with RFC 5424.
        allowNonStandardAppName:
          type: boolean
          title: Allow non-standard app name
          description: Enable if RFC 3164-formatted messages have hyphens in the app name
            portion of the TAG section. If disabled, only alphanumeric
            characters and underscores are allowed. Ignored for RFC
            5424-formatted messages.
        maxActiveCxn:
          type: number
          title: Active connection limit
          description: Maximum number of active connections allowed per Worker Process for
            TCP connections. Use 0 for unlimited.
          minimum: 0
        socketIdleTimeout:
          type: number
          title: TCP socket idle timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. After this time, the connection will be
            closed. Leave at 0 for no inactive socket monitoring.
          minimum: 0
        socketEndingMaxWait:
          type: number
          title: TCP forced socket termination timeout (seconds)
          description: How long the server will wait after initiating a closure for a
            client to close its end of the connection. If the client doesn't
            close the connection within this time, the server will forcefully
            terminate the socket to prevent resource leaks and ensure efficient
            connection cleanup and system stability. Leave at 0 for no inactive
            socket monitoring.
          minimum: 0
        socketMaxLifespan:
          type: number
          title: TCP Socket max lifespan (seconds)
          description: The maximum duration a socket can remain open, even if active. This
            helps manage resources and mitigate issues caused by TCP pinning.
            Set to 0 to disable.
          minimum: 0
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        udpSocketRxBufSize:
          type: number
          title: UDP socket buffer size (bytes)
          description: "Optionally, set the SO_RCVBUF socket option for the UDP socket.
            This value tells the operating system how many bytes can be buffered
            in the kernel before events are dropped. Leave blank to use the OS
            default. Caution: Increasing this value will affect OS memory
            utilization."
          minimum: 256
          maximum: 4294967295
        enableLoadBalancing:
          type: boolean
          title: Enable TCP load balancing
          description: Load balance traffic across all Worker Processes
        description:
          type: string
          title: Description
        enableEnhancedProxyHeaderParsing:
          type: boolean
          title: Enable enhanced TLS handshake for proxy protocol
          description: When enabled, parses PROXY protocol headers during the TLS
            handshake. Disable if compatibility issues arise.
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_udpPort:
          type: string
          description: Binds 'udpPort' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'udpPort' at runtime.
        __template_tcpPort:
          type: string
          description: Binds 'tcpPort' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tcpPort' at runtime.
        __template_timestampTimezone:
          type: string
          description: Binds 'timestampTimezone' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'timestampTimezone' at runtime.
      anyOf:
        - required:
            - host
            - udpPort
        - required:
            - host
            - tcpPort
    InputFile:
      type: object
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          enum:
            - file
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        mode:
          type: string
          enum:
            - manual
            - auto
          x-speakeasy-enum-descriptions:
            - Manual
            - Auto
          description: Choose how to discover files to monitor
          x-speakeasy-unknown-values: allow
        interval:
          type: number
          minimum: 1
          title: Polling interval
          description: Time, in seconds, between scanning for files
        filenames:
          type: array
          title: Filename allowlist
          description: The full path of discovered files are matched against this wildcard
            list
          items:
            type: string
        filterArchivedFiles:
          type: boolean
          title: Apply filename allowlist internal to archive files
          description: Apply filename allowlist to file entries in archive file types,
            like tar or zip.
        tailOnly:
          type: boolean
          title: Collect from end
          description: Read only new entries at the end of all files discovered at next
            startup. @{product} will then read newly discovered files from the
            head. Disable this to resume reading all files from head.
        idleTimeout:
          type: number
          minimum: 1
          title: Idle timeout
          description: Time, in seconds, before an idle file is closed
        minAgeDur:
          type: string
          title: Minimum age duration
          description: "The minimum age of files to monitor. Format examples: 30s, 15m,
            1h. Age is relative to file modification time. Leave empty to apply
            no age filters."
        maxAgeDur:
          type: string
          title: Maximum age duration
          description: 'The maximum age of event timestamps to collect. Format examples:
            60s, 4h, 3d, 1w. Can be used in conjuction with "Check file
            modification times". Leave empty to apply no age filters.'
        checkFileModTime:
          type: boolean
          title: Check file modification times
          description: Skip files with modification times earlier than the maximum age
            duration
        forceText:
          type: boolean
          title: Force text format
          description: Forces files containing binary data to be streamed as text
        hashLen:
          type: number
          minimum: 1
          title: Hash length
          description: Length of file header bytes to use in hash for unique file
            identification
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        disableStaleChannelFlush:
          type: boolean
          title: Disable Event Breaker buffer timeout
          description: When enabled, no Event Breaker channel flush timeout applies and
            the timeout below is ignored. Prefer this option when using
            header-based breakers for file types such as CSV or IIS.
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        description:
          type: string
          title: Description
        path:
          type: string
          title: Search path
          description: "Directory path to search for files. Environment variables will be
            resolved (example: $CRIBL_HOME/log/)."
        depth:
          type: number
          minimum: 0
          title: Max depth
          description: Set how many subdirectories deep to search. Use 0 to search only
            files in the given path, 1 to also look in its immediate
            subdirectories, etc. Leave it empty for unlimited depth.
        suppressMissingPathErrors:
          type: boolean
          title: Suppress errors when search path does not exist
        deleteFiles:
          type: boolean
          title: Delete files
          description: Delete files after they have been collected
        saltHash:
          type: boolean
          title: Salt file hash
          description: Salt the file hash with the Source file path. Ensures that all
            files with the same header hash, such as CSV files, are ingested.
            Moving or renaming the file, or toggling this after starting the
            Source will cause re-ingestion.
        optimizeLeafDirectories:
          type: boolean
          title: Optimize for leaf directories
          description: Skip rescans of unchanged directories based on directory
            modification time. Uses an exponential backoff strategy, reducing
            load on the filesystems, but possibly delaying detection of new
            data. This option is optimized for search paths where files exist in
            the leaf directories.
        includeUnidentifiableBinary:
          type: boolean
          title: Enable binary files
          description: Stream binary files as Base64-encoded chunks
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    InputTcp:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - tcp
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        ipWhitelistRegex:
          type: string
          title: IP allowlist regex
          description: Regex matching IP addresses that are allowed to establish a
            connection
        maxActiveCxn:
          type: number
          title: Active connection limit
          description: Maximum number of active connections allowed per Worker Process.
            Use 0 for unlimited.
          minimum: 0
        socketIdleTimeout:
          type: number
          title: Socket idle timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. After this time, the connection will be
            closed. Leave at 0 for no inactive socket monitoring.
          minimum: 0
        socketEndingMaxWait:
          type: number
          title: Forced socket termination timeout (seconds)
          description: How long the server will wait after initiating a closure for a
            client to close its end of the connection. If the client doesn't
            close the connection within this time, the server will forcefully
            terminate the socket to prevent resource leaks and ensure efficient
            connection cleanup and system stability. Leave at 0 for no inactive
            socket monitoring.
          minimum: 0
        socketMaxLifespan:
          type: number
          title: Socket max lifespan (seconds)
          description: The maximum duration a socket can remain open, even if active. This
            helps manage resources and mitigate issues caused by TCP pinning.
            Set to 0 to disable.
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Enable proxy protocol
          description: Enable if the connection is proxied by a device that supports proxy
            protocol v1 or v2
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        enableHeader:
          type: boolean
          title: Enable header
          description: 'Client will pass the header record with every new connection. The
            header can contain an authToken, and an object with a list of fields
            and values to add to every event. These fields can be used to
            simplify Event Breaker selection, routing, etc. Header has this
            format, and must be followed by a newline: { "authToken" :
            "myToken", "fields": { "field1": "value1", "field2": "value2" } }'
        preprocess:
          $ref: "#/components/schemas/PreprocessType"
        description:
          type: string
          title: Description
        authToken:
          type: string
          title: Auth token
          description: Shared secret to be provided by any client (in authToken header
            field). If empty, unauthorized access is permitted.
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    InputAppscope:
      type: object
      required:
        - type
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - appscope
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        ipWhitelistRegex:
          type: string
          title: IP allowlist regex
          description: Regex matching IP addresses that are allowed to establish a
            connection
        maxActiveCxn:
          type: number
          title: Active connection limit
          description: Maximum number of active connections allowed per Worker Process.
            Use 0 for unlimited.
          minimum: 0
        socketIdleTimeout:
          type: number
          title: Socket idle timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. After this time, the connection will be
            closed. Leave at 0 for no inactive socket monitoring.
          minimum: 0
        socketEndingMaxWait:
          type: number
          title: Forced socket termination timeout (seconds)
          description: How long the server will wait after initiating a closure for a
            client to close its end of the connection. If the client doesn't
            close the connection within this time, the server will forcefully
            terminate the socket to prevent resource leaks and ensure efficient
            connection cleanup and system stability. Leave at 0 for no inactive
            socket monitoring.
          minimum: 0
        socketMaxLifespan:
          type: number
          title: Socket max lifespan (seconds)
          description: The maximum duration a socket can remain open, even if active. This
            helps manage resources and mitigate issues caused by TCP pinning.
            Set to 0 to disable.
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Enable proxy protocol
          description: Enable if the connection is proxied by a device that supports proxy
            protocol v1 or v2
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        enableUnixPath:
          type: boolean
          title: UNIX domain socket
          description: Toggle to Yes to specify a file-backed UNIX domain socket
            connection, instead of a network host and port.
        filter:
          type: object
          properties:
            allow:
              type: array
              title: Rules
              description: Specify processes that AppScope should be loaded into, and the
                config to use.
              items:
                type: object
                properties:
                  procname:
                    type: string
                    title: Process name
                    description: Specify the name of a process or family of processes.
                  arg:
                    type: string
                    title: Process argument
                    description: Specify a string to substring-match against process command-line.
                  config:
                    type: string
                    title: AppScope config
                    description: Choose a config to apply to processes that match the process name
                      and/or argument.
                required:
                  - procname
                  - config
            transportURL:
              type: string
              title: Transport override
              description: To override the UNIX domain socket or address/port specified in
                General Settings (while leaving Authentication settings as is),
                enter a URL.
        persistence:
          type: object
          title: Persistence
          properties:
            enable:
              type: boolean
              title: Enable disk spooling
              description: Spool events and metrics on disk for Cribl Edge and Search
            timeWindow:
              type: string
              title: Bucket time span
              description: Time span for each file bucket
            maxDataSize:
              type: string
              title: Data size limit
              description: "Maximum disk space allowed to be consumed (examples: 420MB, 4GB).
                When limit is reached, older data will be deleted."
              pattern: ^\d+\s*(?:\w{2})?$
            maxDataTime:
              title: Data age limit
              type: string
              description: "Maximum amount of time to retain data (examples: 2h, 4d). When
                limit is reached, older data will be deleted."
              pattern: \d+[smhd]$
            compress:
              $ref: "#/components/schemas/DataCompressionFormatOptionsPersistence"
            destPath:
              type: string
              title: Path location
              description: Path to use to write metrics. Defaults to
                $CRIBL_HOME/state/appscope
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        description:
          type: string
          title: Description
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        unixSocketPath:
          type: string
          title: UNIX socket path
          description: Path to the UNIX domain socket to listen on.
        unixSocketPerms:
          type:
            - string
            - number
          title: UNIX socket permissions
          description: Permissions to set for socket e.g., 777. If empty, falls back to
            the runtime user's default permissions.
        authToken:
          type: string
          title: Auth token
          description: Shared secret to be provided by any client (in authToken header
            field). If empty, unauthorized access is permitted.
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    InputWef:
      type: object
      required:
        - type
        - host
        - port
        - subscriptions
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - wef
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        authMethod:
          type: string
          title: Authentication method
          description: How to authenticate incoming client connections
          enum:
            - clientCert
            - kerberos
          x-speakeasy-enum-descriptions:
            - Client certificate
            - Kerberos
          x-speakeasy-unknown-values: allow
        tls:
          type: object
          title: mTLS settings
          required:
            - privKeyPath
            - certPath
            - caPath
          properties:
            disabled:
              type: boolean
              title: Disabled
              description: Enable TLS
            rejectUnauthorized:
              type: boolean
              title: Validate client certs
              description: Required for WEF certificate authentication
            requestCert:
              type: boolean
              title: Authenticate client
              description: Required for WEF certificate authentication
            certificateName:
              type: string
              title: Certificate
              description: Name of the predefined certificate
            privKeyPath:
              type: string
              title: Private key path
              description: Path on server containing the private key to use. PEM format. Can
                reference $ENV_VARS.
            passphrase:
              type: string
              title: Passphrase
              description: Passphrase to use to decrypt private key
            certPath:
              type: string
              title: Certificate path
              description: Path on server containing certificates to use. PEM format. Can
                reference $ENV_VARS.
            caPath:
              type: string
              title: CA certificate path
              description: Server path containing CA certificates (in PEM format) to use. Can
                reference $ENV_VARS. If multiple certificates are present in a
                .pem, each must directly certify the one preceding it.
            commonNameRegex:
              type: string
              title: Common name
              description: Regex matching allowable common names in peer certificates' subject
                attribute
            minVersion:
              $ref: "#/components/schemas/MinimumTlsVersionOptionsTls"
            maxVersion:
              $ref: "#/components/schemas/MaximumTlsVersionOptionsTls"
            ocspCheck:
              type: boolean
              title: Verify certificate via OCSP
              description: Enable OCSP check of certificate
            ocspCheckFailClose:
              type: boolean
              title: Strict validation
              description: If enabled, checks will fail on any OCSP error. Otherwise, checks
                will fail only when a certificate is revoked, ignoring other
                errors.
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Preserve the client’s original IP address in the __srcIpPort field
            when connecting through an HTTP proxy that supports the
            X-Forwarded-For header. This does not apply to TCP-layer Proxy
            Protocol v1/v2.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events in the __headers field
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        caFingerprint:
          type: string
          title: CA fingerprint override
          description: SHA1 fingerprint expected by the client, if it does not match the
            first certificate in the configured CA chain
        keytab:
          type: string
          title: Keytab location
          description: Path to the keytab file containing the service principal
            credentials. @{product} will use `/etc/krb5.keytab` if not provided.
        principal:
          type: string
          title: Service principal name
          description: Kerberos principal used for authentication, typically in the form
            HTTP/<hostname>@<REALM>
        allowMachineIdMismatch:
          type: boolean
          title: Allow MachineID mismatch
          description: Allow events to be ingested even if their MachineID does not match
            the client certificate CN
        subscriptions:
          title: Subscriptions
          description: Subscriptions to events on forwarding endpoints
          type: array
          items:
            type: object
            required:
              - subscriptionName
              - contentFormat
              - heartbeatInterval
              - batchTimeout
              - targets
            minLength: 1
            properties:
              subscriptionName:
                title: Subscription name
                type: string
              version:
                title: Version
                type: string
                description: Version UUID for this subscription. If any subscription parameters
                  are modified, this value will change.
              contentFormat:
                title: Format
                type: string
                enum:
                  - Raw
                  - RenderedText
                description: Content format in which the endpoint should deliver events
                x-speakeasy-unknown-values: allow
              heartbeatInterval:
                title: Heartbeat
                type: number
                description: Maximum time (in seconds) between endpoint checkins before
                  considering it unavailable
                minimum: 1
              batchTimeout:
                title: Batch timeout
                type: number
                description: Interval (in seconds) over which the endpoint should collect events
                  before sending them to Stream
                minimum: 0
              readExistingEvents:
                title: Read existing events
                type: boolean
                description: Newly subscribed endpoints will send previously existing events.
                  Disable to receive new events only.
              sendBookmarks:
                title: Use bookmarks
                type: boolean
                description: Keep track of which events have been received, resuming from that
                  point after a re-subscription. This setting takes precedence
                  over 'Read existing events'. See [Cribl
                  Docs](https://docs.cribl.io/stream/sources-wef/#subscriptions)
                  for more details.
              compress:
                title: Compression
                type: boolean
                description: Receive compressed events from the source
              targets:
                type: array
                title: Targets
                description: The DNS names of the endpoints that should forward these events.
                  You may use wildcards, such as *.mydomain.com
                items:
                  type: string
                  minLength: 1
              locale:
                title: Locale
                type: string
                description: The RFC-3066 locale the Windows clients should use when sending
                  events. Defaults to "en-US".
              querySelector:
                type: string
                title: Query builder mode
                enum:
                  - simple
                  - xml
                x-speakeasy-unknown-values: allow
              metadata:
                type: array
                title: Fields
                description: Fields to add to events ingested under this subscription
                items:
                  $ref: "#/components/schemas/MetadataConfInputCollection"
              queries:
                type: array
                title: Queries
                items:
                  type: object
                  minLength: 1
                  required:
                    - path
                    - queryExpression
                  properties:
                    path:
                      type: string
                      title: Path
                      description: The Path attribute from the relevant XML Select element
                    queryExpression:
                      type: string
                      title: Query expression
                      description: The XPath query inside the relevant XML Select element
              xmlQuery:
                type: string
                title: XML query
                description: The XPath query to use for selecting events
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        logFingerprintMismatch:
          type: boolean
          title: Log CA fingerprint mismatch warning
          description: Log a warning if the client certificate authority (CA) fingerprint
            does not match the expected value. A mismatch prevents Cribl from
            receiving events from the Windows Event Forwarder.
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_keytab:
          type: string
          description: Binds 'keytab' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'keytab' at runtime.
        __template_principal:
          type: string
          description: Binds 'principal' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'principal' at runtime.
    InputWinEventLogs:
      type: object
      required:
        - type
        - logNames
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - win_event_logs
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        logNames:
          type: array
          title: Event logs
          description: Enter the event logs to collect. Run "Get-WinEvent -ListLog *" in
            PowerShell to see the available logs.
          items:
            minLength: 1
            type: string
          minItems: 1
          uniqueItems: true
        readMode:
          type: string
          enum:
            - oldest
            - newest
          title: Read mode
          x-speakeasy-enum-descriptions:
            - Entire log
            - From last entry
          description: Read all stored and future event logs, or only future events
          x-speakeasy-unknown-values: allow
        eventFormat:
          type: string
          enum:
            - json
            - xml
          title: Event format
          x-speakeasy-enum-descriptions:
            - JSON
            - XML
          description: Format of individual events
          x-speakeasy-unknown-values: allow
        disableNativeModule:
          type: boolean
          title: Use Windows Tools
          description: Enable to use built-in tools (PowerShell for JSON, wevtutil for
            XML) to collect event logs instead of native API (default) [Learn
            more](https://docs.cribl.io/edge/sources-windows-event-logs/#advanced-settings)
        interval:
          type: number
          minimum: 1
          title: Polling interval
          description: Time, in seconds, between checking for new entries (Applicable for
            pre-4.8.0 nodes that use Windows Tools)
        batchSize:
          type: number
          minimum: 1
          title: Batch size
          description: The maximum number of events to read in one polling interval. A
            batch size higher than 500 can cause delays when pulling from
            multiple event logs. (Applicable for pre-4.8.0 nodes that use
            Windows Tools)
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        maxEventBytes:
          type: number
          title: Event byte limit
          description: The maximum number of bytes in an event before it is flushed to the
            pipelines
          minimum: 1
          maximum: 134217728
        description:
          type: string
          title: Description
        disableJsonRendering:
          type: boolean
          title: Render event message strings
          description: Enable/disable the rendering of localized event message strings
            (Applicable for 4.8.0 nodes and newer that use the Native API)
        disableXmlRendering:
          type: boolean
          title: Render event message strings
          description: Enable/disable the rendering of localized event message strings
            (Applicable for 4.8.0 nodes and newer that use the Native API)
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    InputAppleUnifiedLogs:
      type: object
      required:
        - type
        - predicate
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - apple_unified_logs
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        predicate:
          type: string
          title: Predicate
          description: String to filter log entries, in NSPredicate format (e.g.,
            subsystem == "com.apple.security" or process == "kernel"). See
            [Common Log Types and
            Predicates](https://docs.cribl.io/edge/sources-apple-unified-logs/#examples)
            for more information.
          minLength: 1
        readMode:
          type: string
          enum:
            - oldest
            - newest
          title: Read mode
          x-speakeasy-enum-descriptions:
            - Entire log
            - From last entry
          description: Read all log entries (historical and upcoming), or only upcoming,
            from the last entry
          x-speakeasy-unknown-values: allow
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    InputRawUdp:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - raw_udp
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. For IPv4 (all addresses), use the default
            '0.0.0.0'. For IPv6, enter '::' (all addresses) or specify an IP
            address.
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        maxBufferSize:
          type: number
          title: Buffer size limit (events)
          description: Maximum number of events to buffer when downstream is blocking.
          minimum: 0
        ipWhitelistRegex:
          type: string
          title: IP allowlist regex
          description: Regex matching IP addresses that are allowed to send data
        singleMsgUdpPackets:
          type: boolean
          title: Single msg per UDP
          description: If true, each UDP packet is assumed to contain a single message. If
            false, each UDP packet is assumed to contain multiple messages,
            separated by newlines.
        ingestRawBytes:
          type: boolean
          title: Ingest raw bytes
          description: If true, a __rawBytes field will be added to each event containing
            the raw bytes of the datagram.
        udpSocketRxBufSize:
          type: number
          title: UDP socket buffer size (bytes)
          description: "Optionally, set the SO_RCVBUF socket option for the UDP socket.
            This value tells the operating system how many bytes can be buffered
            in the kernel before events are dropped. Leave blank to use the OS
            default. Caution: Increasing this value will affect OS memory
            utilization."
          minimum: 256
          maximum: 4294967295
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    InputJournalFiles:
      type: object
      required:
        - type
        - path
        - journals
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          enum:
            - journal_files
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        path:
          type: string
          title: Search path
          description: Directory path to search for journals. Environment variables will
            be resolved, e.g. $CRIBL_EDGE_FS_ROOT/var/log/journal/$MACHINE_ID.
        interval:
          type: number
          minimum: 1
          title: Polling interval
          description: "Time, in seconds, between scanning for journals. "
        journals:
          type: array
          title: Journal allowlist
          description: The full path of discovered journals are matched against this
            wildcard list.
          items:
            type: string
        rules:
          type: array
          title: Filter Rules
          description: Add rules to decide which journal objects to allow. Events are
            generated if no rules are given or if all the rules' expressions
            evaluate to true.
          items:
            type: object
            required:
              - filter
            properties:
              filter:
                type: string
                title: Filter Expression
                description: JavaScript expression applied to Journal objects. Return 'true' to
                  include it.
              description:
                type: string
                title: Description
                description: Optional description of this rule's purpose
        currentBoot:
          type: boolean
          title: Current boot only
          description: Skip log messages that are not part of the current boot session
        maxAgeDur:
          type: string
          title: Age duration limit
          description: "The maximum log message age, in duration form (e.g,: 60s, 4h, 3d,
            1w).  Default of no value will apply no max age filters."
        suppressMissingPathErrors:
          type: boolean
          title: Suppress errors when search path does not exist
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    InputWiz:
      type: object
      required:
        - type
        - endpoint
        - authUrl
        - clientId
        - contentConfig
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - wiz
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        endpoint:
          type: string
          title: GraphQL endpoint
          description: "The Wiz GraphQL API endpoint. Example:
            https://api.us1.app.wiz.io/graphql"
          pattern: ^https:\/\/
        authUrl:
          type: string
          title: Authentication URL
          description: The authentication URL to generate an OAuth token
        authAudienceOverride:
          type: string
          title: Authentication audience
          description: The audience to use when requesting an OAuth token for a custom
            auth URL. When not specified, `wiz-api` will be used.
        clientId:
          type: string
          title: Client ID
          description: The client ID of the Wiz application
        contentConfig:
          type: array
          title: Content types
          items:
            type: object
            required:
              - contentType
              - contentQuery
              - cronSchedule
              - earliest
              - latest
            properties:
              contentType:
                type: string
                title: Content name
                description: The name of the Wiz query
                pattern: ^[a-zA-Z0-9_-\s]+$
              contentDescription:
                type: string
                title: Description
              enabled:
                type: boolean
                title: Enable content
              stateTracking:
                type: boolean
                title: State tracking
                description: Track collection progress between consecutive scheduled executions
              stateUpdateExpression:
                type: string
                title: State update expression
                description: JavaScript expression that defines how to update the state from an
                  event. Use the event's data and the current state to compute
                  the new state. See [Understanding State Expression
                  Fields](https://docs.cribl.io/stream/collectors-rest#state-tracking-expression-fields)
                  for more information.
              stateMergeExpression:
                type: string
                title: State merge expression
                description: JavaScript expression that defines which state to keep when merging
                  a task's newly reported state with previously saved state.
                  Evaluates `prevState` and `newState` variables, resolving to
                  the state to keep.
              manageState:
                type: object
              contentQuery:
                type: string
                title: Content query
                description: "Template for POST body to send with the Collect request. Reference
                  global variables, or functions using template params:
                  `${C.vars.myVar}`, or `${Date.now()}`, `${param}`."
              cronSchedule:
                type: string
                title: Cron schedule
                description: A cron schedule on which to run this job
              earliest:
                type: string
                title: Earliest time
                description: "Earliest time, relative to now. Format supported:
                  [+|-]<time_integer><time_unit>@<snap-to_time_unit> (ex: -1hr,
                  -42m, -42m@h)"
              latest:
                type: string
                title: Latest time
                description: "Latest time, relative to now. Format supported:
                  [+|-]<time_integer><time_unit>@<snap-to_time_unit> (ex: -1hr,
                  -42m, -42m@h)"
              jobTimeout:
                title: Job timeout
                type: string
                description: "Maximum time the job is allowed to run (examples: 30, 45s, 15m).
                  Units default to seconds if not specified. Enter 0 for
                  unlimited time."
                pattern: ^\d+[sm]?$
              logLevel:
                $ref: "#/components/schemas/LogLevelOptionsContentConfigItemsDebugError"
              maxPages:
                type: number
                title: Page limit
                description: Maximum number of pages to retrieve per collection task. Defaults
                  to 0. Set to 0 to retrieve all pages.
                minimum: 0
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout. Use 0 to disable.
          minimum: 0
          maximum: 2400
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        retryRules:
          $ref: "#/components/schemas/RetryRulesType"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsManualSecret"
        description:
          type: string
          title: Description
        clientSecret:
          type: string
          title: Client secret
          description: The client secret of the Wiz application
        textSecret:
          type: string
          title: Client Secret (text secret)
          description: Select or create a stored text secret
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_authUrl:
          type: string
          description: Binds 'authUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'authUrl' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
    InputOpenai:
      type: object
      required:
        - type
        - contentConfig
        - textSecret
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - openai
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        openaiOrganization:
          type: string
          title: OpenAI Organization
          description: Optional `OpenAI-Organization` request header value, typically
            `org-xxxxxxxxxxxxxxxxxxxxxxxx`
        openaiProject:
          type: string
          title: OpenAI Project
          description: Optional `OpenAI-Project` request header value, typically
            `proj_xxxxxxxxxxxxxxxxxxxxxxxx`
        contentConfig:
          type: array
          title: Content Types
          items:
            type: object
            required:
              - contentType
              - collectPath
              - requestParams
              - paginationType
              - cronSchedule
              - earliest
              - latest
            properties:
              contentType:
                type: string
                title: Content type
                readOnly: true
              contentDescription:
                type: string
                title: Description
                readOnly: true
              collectPath:
                type: string
                title: Endpoint
                description: OpenAI Organization API path
                readOnly: true
              docsUrl:
                type: string
                title: Docs URL
                readOnly: true
              disabled:
                type: boolean
                title: Enabled
              stateTracking:
                type: boolean
                title: State tracking
                description: Track collection progress between consecutive scheduled executions.
              stateUpdateExpression:
                type: string
                title: State update expression
                description: JavaScript expression that defines how to update the state from an
                  event
              stateMergeExpression:
                type: string
                title: State merge expression
                description: JavaScript expression that defines which state to keep when merging
                  task state
              manageState:
                type: object
              requestParams:
                type: array
                title: Query parameters
                description: Query-string parameters to send with this endpoint
                items:
                  $ref: "#/components/schemas/HttpDiscoveryHeaderConfInputPrometheus"
              paginationType:
                type: string
                title: Pagination type
                enum:
                  - none
                  - response_body
                  - response_header
                  - response_header_link
                x-speakeasy-enum-descriptions:
                  - None
                  - Response Body Attribute
                  - Response Header Attribute
                  - RFC 5988 Link Header
                x-speakeasy-unknown-values: allow
              paginationAttribute:
                type: array
                title: Pagination attributes
                items:
                  type: string
              paginationLastPageExpr:
                type: string
                title: Last page expression
              maxPages:
                type: number
                title: Page limit
                description: Maximum number of pages to retrieve per collection task. Set to 0
                  only when unlimited pagination is required.
                minimum: 0
              paginationNextRelationAttribute:
                type: string
                title: Next relation attribute
                description: Used only for RFC 5988 link-header pagination
              paginationCurRelationAttribute:
                type: string
                title: Current relation attribute
                description: Optional relation that represents the current page
              cronSchedule:
                type: string
                title: Cron schedule
                description: A cron schedule on which to run this job
              earliest:
                type: string
                title: Earliest time
                description: Relative to the current time
              latest:
                type: string
                title: Latest time
                description: Relative to the current time
              jobTimeout:
                title: Job timeout
                type: string
                description: "Maximum time the job is allowed to run (examples: 30, 45s, 15m).
                  Enter 0 for unlimited time."
                pattern: ^\d+[sm]?$
              logLevel:
                type: string
                title: Log level
                enum:
                  - error
                  - warn
                  - info
                  - debug
                  - silly
                description: Collector runtime log level.
                x-speakeasy-unknown-values: allow
              endpointMetadata:
                type: array
                title: Hardcoded fields
                description: Fields automatically added to events from this Content Type
                items:
                  $ref: "#/components/schemas/MetadataConfInputCollection"
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout. Use 0 to disable.
          minimum: 0
          maximum: 2400
        apiKey:
          type: string
          title: API key
        textSecret:
          type: string
          title: API key (text secret)
          description: Select or create a stored API key. Visit [OpenAI's organization
            admin keys
            page](https://platform.openai.com/settings/organization/admin-keys)
            to create an organization admin key.
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        retryRules:
          $ref: "#/components/schemas/RetryRulesType"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_openaiOrganization:
          type: string
          description: Binds 'openaiOrganization' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'openaiOrganization' at runtime.
        __template_openaiProject:
          type: string
          description: Binds 'openaiProject' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'openaiProject' at runtime.
    InputWizWebhook:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - wiz_webhook
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        authTokens:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            type: string
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        enableHealthCheck:
          type: boolean
          title: Health check endpoint
          description: Expose the /cribl_health endpoint, which returns 200 OK when this
            Source is healthy
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        allowedPaths:
          type: array
          title: Allowed URI paths
          description: List of URI paths accepted by this input. Wildcards are supported
            (such as /api/v*/hook). Defaults to allow all.
          items:
            type: string
            minLength: 1
        allowedMethods:
          type: array
          title: Allowed HTTP methods
          description: List of HTTP methods accepted by this input. Wildcards are
            supported (such as P*, GET). Defaults to allow all.
          items:
            type: string
            minLength: 1
        authTokensExt:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            $ref: "#/components/schemas/AuthTokensExtConfInputHttp"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_authTokens:
          type: string
          description: Binds 'authTokens' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'authTokens' at runtime.
        __template_allowedPaths:
          type: string
          description: Binds 'allowedPaths' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'allowedPaths' at runtime.
    InputNetflow:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - netflow
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. For IPv4 (all addresses), use the default
            '0.0.0.0'. For IPv6, enter '::' (all addresses) or specify an IP
            address.
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        enablePassThrough:
          type: boolean
          title: Enable pass-through
          description: Allow forwarding of events to a NetFlow destination. Enabling this
            feature will generate an extra event containing __netflowRaw which
            can be routed to a NetFlow destination. Note that these events will
            not count against ingest quota.
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist.
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        udpSocketRxBufSize:
          type: number
          title: UDP socket buffer size (bytes)
          description: "Optionally, set the SO_RCVBUF socket option for the UDP socket.
            This value tells the operating system how many bytes can be buffered
            in the kernel before events are dropped. Leave blank to use the OS
            default. Caution: Increasing this value will affect OS memory
            utilization."
          minimum: 256
          maximum: 4294967295
        templateCacheMinutes:
          type: number
          title: Template cache minutes
          description: Specifies how many minutes NetFlow v9 templates are cached before
            being discarded if not refreshed. Adjust based on your network's
            template update frequency to optimize performance and memory usage.
          minimum: 1
          maximum: 3600
        v5Enabled:
          type: boolean
          title: V5
          description: Accept messages in Netflow V5 format.
        v9Enabled:
          type: boolean
          title: V9
          description: Accept messages in Netflow V9 format.
        ipfixEnabled:
          type: boolean
          title: IPFIX
          description: Accept messages in IPFIX format.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    InputSecurityLake:
      type: object
      required:
        - type
        - queueName
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - security_lake
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        queueName:
          type: string
          title: Queue
          description: "The name, URL, or ARN of the SQS queue to read notifications from.
            When a non-AWS URL is specified, format must be:
            '{url}/myQueueName'. Example: 'https://host:port/myQueueName'. Value
            must be a JavaScript expression (which can evaluate to a constant
            value), enclosed in quotes or backticks. Can be evaluated only at
            init time. Example referencing a Global Variable:
            `https://host:port/myQueue-${C.vars.myVar}`."
        fileFilter:
          type: string
          title: Filename filter
          description: "Regex matching file names to download and process. Defaults to: .*"
        awsAccountId:
          title: AWS account ID
          description: SQS queue owner's AWS account ID. Leave empty if SQS queue is in
            same AWS account.
          type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: AWS Region where the S3 bucket and SQS queue are located. Required,
            unless the Queue entry is a URL or ARN that includes a Region.
        endpoint:
          type: string
          title: Endpoint
          description: S3 service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to S3-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        maxMessages:
          type: number
          title: Message limit
          description: "The maximum number of messages SQS should return in a poll
            request. Amazon SQS never returns more messages than this value
            (however, fewer messages might be returned). Valid values: 1 to 10."
          minimum: 1
          maximum: 10
        visibilityTimeout:
          type: number
          title: Visibility timeout seconds
          description: After messages are retrieved by a ReceiveMessage request,
            @{product} will hide them from subsequent retrieve requests for at
            least this duration. You can set this as high as 43200 sec. (12
            hours).
          minimum: 0
          maximum: 43200
        numReceivers:
          type: number
          title: Number of receivers
          description: How many receiver processes to run. The higher the number, the
            better the throughput - at the expense of CPU overhead.
          minimum: 1
          maximum: 100
        socketTimeout:
          type: number
          title: Socket timeout
          description: Socket inactivity timeout (in seconds). Increase this value if
            timeouts occur due to backpressure.
          minimum: 1
          maximum: 43200
        skipOnError:
          type: boolean
          title: Skip file on error
          description: Skip files that trigger a processing error. Disabled by default,
            which allows retries after processing errors.
        includeSqsMetadata:
          type: boolean
          title: Include notification metadata
          description: Attach SQS notification metadata to a __sqsMetadata field on each
            event
        enableAssumeRole:
          type: boolean
          title: Enable for Amazon S3
          description: Use Assume Role credentials to access Amazon S3
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        enableSQSAssumeRole:
          type: boolean
          title: Enable for Amazon SQS
          description: Use Assume Role credentials when accessing Amazon SQS
        preprocess:
          $ref: "#/components/schemas/PreprocessType"
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        parquetChunkSizeMB:
          type: number
          title: Parquet chunk size limit (MB)
          description: Maximum file size for each Parquet chunk
          maximum: 100
          minimum: 1
        parquetChunkDownloadTimeout:
          type: number
          title: Parquet chunk download timeout (seconds)
          description: The maximum time allowed for downloading a Parquet chunk.
            Processing will stop if a chunk cannot be downloaded within the time
            specified.
          maximum: 3600
          minimum: 1
        checkpointing:
          $ref: "#/components/schemas/CheckpointingType"
        pollTimeout:
          type: number
          title: Poll timeout (secs)
          description: How long to wait for events before trying polling again. The lower
            the number the higher the AWS bill. The higher the number the longer
            it will take for the source to react to configuration changes and
            system restarts.
          minimum: 1
          maximum: 20
        encoding:
          type: string
          title: Encoding
          description: Character encoding to use when parsing ingested data. When not set,
            @{product} will default to UTF-8 but may incorrectly interpret
            multi-byte characters.
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        tagAfterProcessing:
          $ref: "#/components/schemas/TagAfterProcessingOptions"
        processedTagKey:
          type: string
          title: Tag key
          description: The key for the S3 object tag applied after processing. This field
            accepts an expression for dynamic generation.
        processedTagValue:
          type: string
          title: Tag value
          description: The value for the S3 object tag applied after processing. This
            field accepts an expression for dynamic generation.
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_queueName:
          type: string
          description: Binds 'queueName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'queueName' at runtime.
        __template_awsAccountId:
          type: string
          description: Binds 'awsAccountId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsAccountId' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    InputServicenowTable:
      type: object
      required:
        - type
        - instance
        - cronSchedule
        - earliest
        - latest
        - tableName
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - servicenow_table
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        instance:
          type: string
          pattern: .*\S.*
          title: Instance URL
          description: ServiceNow instance base URL for Table API requests. Enter a
            literal URL (http or https and the instance host, for example a
            hostname ending in .service-now.com) or a Cribl expression that
            resolves to a URL.
        tableName:
          type: string
          pattern: .*\S.*
          title: Table name
          description: ServiceNow table name to collect from.
        fields:
          type: array
          title: Fields
          description: Field names to return from the Table API (sysparm_fields). Leave
            empty to return all fields.
          items:
            type: string
            pattern: ^[^*?\[\]]+$
        orderByField:
          type: string
          title: Sort by field
          description: Optional. Sort results by this field (for example sys_created_on or
            parent.name). Leave empty to use the server default order.
        orderByDirection:
          type: string
          title: Sort direction
          description: Used only when Sort by field is set.
          enum:
            - asc
            - desc
          x-speakeasy-enum-descriptions:
            - Ascending
            - Descending
          x-speakeasy-unknown-values: allow
        query:
          type: string
          title: Filter query (advanced)
          description: Optional ServiceNow encoded query for sysparm_query (for example
            active=true or sys_updated_onRELATIVEGT@hour@ago@1). Enter a literal
            or a Cribl expression. When combined with Sort by field, the filter
            and sort are joined with ^. See ServiceNow Table API documentation
            for encoded query syntax.
        pageSize:
          type: integer
          title: Page size
          description: Maximum records per Table API page request (sysparm_limit). Setting
            a higher value may increase the risk of timeouts.
          minimum: 1
        maxPages:
          type: integer
          title: Page limit
          description: Maximum number of pages to retrieve per collection task. Set to 0
            to retrieve all pages.
          minimum: 0
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA
            (such as self-signed certificates)
        authType:
          type: string
          title: Authentication type
          description: ServiceNow Table API authentication method
          enum:
            - none
            - basicSecret
            - oauthSecret
          x-speakeasy-enum-descriptions:
            - None
            - Basic
            - OAuth
          x-speakeasy-unknown-values: allow
        cronSchedule:
          type: string
          pattern: .*\S.*
          title: Cron schedule
          description: Cron schedule on which to run this job
        earliest:
          type: string
          pattern: .*\S.*
          title: Earliest time
          description: "Earliest time, relative to now. Format supported:
            [+|-]<time_integer><time_unit>@<snap-to_time_unit> (ex: -1hr, -42m,
            -42m@h)"
        latest:
          type: string
          pattern: .*\S.*
          title: Latest time
          description: "Latest time, relative to now. Format supported:
            [+|-]<time_integer><time_unit>@<snap-to_time_unit> (ex: -1hr, -42m,
            -42m@h)"
        stateTracking:
          type: boolean
          title: State tracking
          description: Track collection progress between consecutive scheduled executions
        logLevel:
          $ref: "#/components/schemas/LogLevelOptions"
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout. Use 0 to disable.
          minimum: 0
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: When a DNS server returns multiple addresses, @{product} cycles
            through them in the order returned
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        jobTimeout:
          type: string
          title: Job timeout
          description: Maximum time the job is allowed to run (e.g., 30, 45s or 15m).
            Units are seconds, if not specified. Enter 0 for unlimited time.
          pattern: ^\d+[sm]?$
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        retryRules:
          $ref: "#/components/schemas/RetryRulesType"
        description:
          type: string
          title: Description
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        oauthGrantType:
          enum:
            - client_credentials
            - password
          type: string
          title: Grant type
          description: ServiceNow OAuth grant type used for token requests
          x-speakeasy-enum-descriptions:
            - Password
            - Client credentials
          x-speakeasy-unknown-values: allow
        username:
          type: string
          title: Username
          description: ServiceNow username for the password grant type
          pattern: .*\S.*
        textSecret:
          type: string
          title: Password
          description: Select or create a stored text secret for the ServiceNow password
            value
        useCustomOAuthParamsOrHeaders:
          type: boolean
          title: Use custom parameters and/or headers
          description: Enable custom OAuth request parameters or headers for advanced
            ServiceNow configurations. Leave disabled for standard ServiceNow
            OAuth flows.
        oauthParams:
          type: array
          title: OAuth parameters
          description: Additional parameters to send in the OAuth login request.
            @{product} will combine the secret with these parameters, and will
            send the URL-encoded result in a POST request to the endpoint
            specified in the 'Login URL'. We'll automatically add the
            content-type header 'application/x-www-form-urlencoded' when sending
            this request.
          items:
            $ref: "#/components/schemas/OauthParamConfInputServicenowTable"
        oauthHeaders:
          type: array
          title: OAuth headers
          description: Additional headers to send in the OAuth login request. @{product}
            will automatically add the content-type header
            'application/x-www-form-urlencoded' when sending this request.
          items:
            $ref: "#/components/schemas/OauthHeaderConfInputServicenowTable"
        clientId:
          type: string
          title: ServiceNow OAuth client ID
          pattern: .*\S.*
        clientTextSecret:
          type: string
          title: Client secret
          description: Select or create a stored text secret for the OAuth client secret
            value
        stateUpdateExpression:
          type: string
          title: State update expression
          description: JavaScript expression that defines how to update the state from an
            event. This source defaults to checking that `_time` is a finite
            number (not only `__timestampExtracted`), so state still advances
            when the event breaker assigns a fallback time. See [Understanding
            State Expression
            Fields](https://docs.cribl.io/stream/collectors-rest#state-tracking-expression-fields).
        stateMergeExpression:
          type: string
          title: State merge expression
          description: JavaScript expression that defines which state to keep when merging
            a task's newly reported state with previously saved state. Evaluates
            `prevState` and `newState` variables, resolving to the state to
            keep.
        manageState:
          type: object
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_instance:
          type: string
          description: Binds 'instance' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'instance' at runtime.
        __template_orderByField:
          type: string
          description: Binds 'orderByField' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'orderByField' at runtime.
        __template_query:
          type: string
          description: Binds 'query' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'query' at runtime.
        __template_username:
          type: string
          description: Binds 'username' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'username' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
    InputZscalerHec:
      type: object
      required:
        - type
        - host
        - port
        - hecAPI
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - zscaler_hec
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        authTokens:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            type: object
            required:
              - token
            properties:
              authType:
                $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
              tokenSecret:
                type: string
                title: Token secret (text secret)
                description: Select or create a stored text secret
              token:
                type: string
                title: Token
                description: "Shared secret to be provided by any client (Authorization:
                  <token>)"
              enabled:
                type: boolean
                title: Enable token
              description:
                type: string
                title: Description
              allowedIndexesAtToken:
                type: array
                title: Allowed indexes
                description: Enter the values you want to allow in the HEC event index field at
                  the token level. Supports wildcards. To skip validation, leave
                  blank.
                minItems: 0
                items:
                  type: string
                  minLength: 1
              metadata:
                type: array
                title: Fields
                description: Fields to add to events referencing this token
                items:
                  $ref: "#/components/schemas/MetadataConfInputCollection"
        tls:
          $ref: "#/components/schemas/TlsSettingsServerSideType"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        hecAPI:
          type: string
          title: HEC endpoint
          description: Absolute path on which to listen for the Zscaler HTTP Event
            Collector API requests. This input supports the /event endpoint.
          pattern: ^/
        metadata:
          type: array
          title: Fields
          description: Fields to add to every event. May be overridden by fields added at
            the token or request level.
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        allowedIndexes:
          type: array
          title: Allowed indexes
          description: List values allowed in HEC event index field. Leave blank to skip
            validation. Supports wildcards. The values here can expand index
            validation at the token level.
          minItems: 0
          items:
            type: string
            minLength: 1
        hecAcks:
          type: boolean
          title: Zscaler HEC Acks
          description: Whether to enable Zscaler HEC acknowledgements
        accessControlAllowOrigin:
          title: CORS allowed origins
          type: array
          description: Optionally, list HTTP origins to which @{product} should send CORS
            (cross-origin resource sharing) Access-Control-Allow-* headers.
            Supports wildcards.
          minItems: 0
          items:
            type: string
            minLength: 1
        accessControlAllowHeaders:
          title: CORS allowed headers
          type: array
          description: Optionally, list HTTP headers that @{product} will send to allowed
            origins as "Access-Control-Allow-Headers" in a CORS preflight
            response. Use "*" to allow all headers.
          minItems: 0
          items:
            type: string
            minLength: 1
        emitTokenMetrics:
          type: boolean
          title: Emit per-token request metrics
          description: Enable to emit per-token (<prefix>.http.perToken) and summary
            (<prefix>.http.summary) request metrics
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_hecAPI:
          type: string
          description: Binds 'hecAPI' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'hecAPI' at runtime.
    InputCloudflareHec:
      type: object
      required:
        - type
        - host
        - port
        - hecAPI
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - cloudflare_hec
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        host:
          type: string
          title: Address
          description: Address to bind on. Defaults to 0.0.0.0 (all addresses).
        port:
          type: number
          title: Port
          maximum: 65535
          description: Port to listen on
        authTokens:
          type: array
          title: Auth tokens
          description: "Shared secrets to be provided by any client (Authorization:
            <token>). If empty, unauthorized access is permitted."
          items:
            type: object
            properties:
              authType:
                title: Authentication method
                type: string
                enum:
                  - secret
                description: Select Secret to use a text secret to authenticate
                x-speakeasy-unknown-values: allow
              tokenSecret:
                type: string
                title: Token secret (text secret)
                description: Select or create a stored text secret
              token:
                type: string
                title: Token
                description: "Shared secret to be provided by any client (Authorization:
                  <token>)"
              enabled:
                type: boolean
                title: Enable token
              description:
                type: string
                title: Description
              allowedIndexesAtToken:
                type: array
                title: Allowed indexes
                description: Enter the values you want to allow in the HEC event index field at
                  the token level. Supports wildcards. To skip validation, leave
                  blank.
                minItems: 0
                items:
                  type: string
                  minLength: 1
              metadata:
                type: array
                title: Fields
                description: Fields to add to events referencing this token
                items:
                  $ref: "#/components/schemas/MetadataConfInputCollection"
        tls:
          type: object
          title: TLS settings (server side)
          properties:
            disabled:
              type: boolean
              title: Disabled
              description: Enable or disable TLS. Defaults to enabled for Cloudflare sources.
            requestCert:
              type: boolean
              title: Authenticate client (mutual auth)
              description: Require clients to present their certificates. Used to perform
                client authentication using SSL certs.
            rejectUnauthorized:
              type: boolean
              title: Validate client certificates
              description: Reject certificates not authorized by a CA in the CA certificate
                path or by another trusted CA (such as the system's)
            commonNameRegex:
              type: string
              title: Common name
              description: Regex matching allowable common names in peer certificates' subject
                attribute
            certificateName:
              type: string
              title: Certificate
              description: The name of the predefined certificate
            privKeyPath:
              type: string
              title: Private key path
              description: Path on server containing the private key to use. PEM format. Can
                reference $ENV_VARS. Defaults to the built-in Cribl private key
                when TLS is enabled.
            passphrase:
              type: string
              title: Passphrase
              description: Passphrase to use to decrypt private key
            certPath:
              type: string
              title: Certificate path
              description: Path on server containing certificates to use. PEM format. Can
                reference $ENV_VARS. Defaults to the built-in Cribl certificate
                when TLS is enabled.
            caPath:
              type: string
              title: CA certificate path
              description: Path on server containing CA certificates to use. PEM format. Can
                reference $ENV_VARS.
            minVersion:
              $ref: "#/components/schemas/MinimumTlsVersionOptionsTls"
            maxVersion:
              $ref: "#/components/schemas/MaximumTlsVersionOptionsTls"
        maxActiveReq:
          type: number
          title: Active request limit
          description: "Maximum number of active requests allowed per Worker Process. Set
            to 0 for unlimited. Caution: Increasing the limit above the default
            value, or setting it to unlimited, may degrade performance and
            reduce throughput."
          minimum: 0
        maxRequestsPerSocket:
          type: integer
          title: Requests-per-socket limit
          description: Maximum number of requests per socket before @{product} instructs
            the client to close the connection. Default is 0 (unlimited).
          minimum: 0
        enableProxyHeader:
          type: boolean
          title: Show originating IP
          description: Extract the client IP and port from PROXY protocol v1/v2. When
            enabled, the X-Forwarded-For header is ignored. Disable to use the
            X-Forwarded-For header for client IP extraction.
        captureHeaders:
          type: boolean
          title: Capture request headers
          description: Add request headers to events, in the __headers field
        activityLogSampleRate:
          type: number
          title: Activity log sample rate
          description: How often request activity is logged at the `info` level. A value
            of 1 would log every request, 10 every 10th request, etc.
          minimum: 1
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: How long to wait for an incoming request to complete before
            aborting it. Use 0 to disable.
          minimum: 0
        socketTimeout:
          type: number
          title: Socket timeout (seconds)
          description: How long @{product} should wait before assuming that an inactive
            socket has timed out. To wait forever, set to 0.
          minimum: 0
        keepAliveTimeout:
          type: number
          title: Keep-alive timeout (seconds)
          description: After the last response is sent, @{product} will wait this long for
            additional data before closing the socket connection. Minimum 1
            second, maximum 600 seconds (10 minutes).
          minimum: 1
          maximum: 600
        ipAllowlistRegex:
          type: string
          title: IP allowlist regex
          description: Messages from matched IP addresses will be processed, unless also
            matched by the denylist
        ipDenylistRegex:
          type: string
          title: IP denylist regex
          description: Messages from matched IP addresses will be ignored. This takes
            precedence over the allowlist.
        hecAPI:
          type: string
          title: HEC endpoint
          description: Absolute path on which to listen for the Cloudflare HTTP Event
            Collector API requests. This input supports the /event endpoint.
          pattern: ^/
        metadata:
          type: array
          title: Fields
          description: Fields to add to every event. May be overridden by fields added at
            the token or request level.
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        allowedIndexes:
          type: array
          title: Allowed indexes
          description: List values allowed in HEC event index field. Leave blank to skip
            validation. Supports wildcards. The values here can expand index
            validation at the token level.
          minItems: 0
          items:
            type: string
            minLength: 1
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        accessControlAllowOrigin:
          title: CORS allowed origins
          type: array
          description: HTTP origins to which @{product} should send CORS (cross-origin
            resource sharing) Access-Control-Allow-* headers. Supports
            wildcards.
          minItems: 0
          items:
            type: string
            minLength: 1
        accessControlAllowHeaders:
          title: CORS allowed headers
          type: array
          description: HTTP headers that @{product} will send to allowed origins as
            "Access-Control-Allow-Headers" in a CORS preflight response. Use "*"
            to allow all headers.
          minItems: 0
          items:
            type: string
            minLength: 1
        emitTokenMetrics:
          type: boolean
          title: Emit per-token request metrics
          description: Emit per-token (<prefix>.http.perToken) and summary
            (<prefix>.http.summary) request metrics
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_hecAPI:
          type: string
          description: Binds 'hecAPI' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'hecAPI' at runtime.
        __template_allowedIndexes:
          type: string
          description: Binds 'allowedIndexes' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'allowedIndexes' at
            runtime.
        __template_accessControlAllowOrigin:
          type: string
          description: Binds 'accessControlAllowOrigin' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'accessControlAllowOrigin' at runtime.
        __template_accessControlAllowHeaders:
          type: string
          description: Binds 'accessControlAllowHeaders' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'accessControlAllowHeaders' at runtime.
    InputOpenaiComplianceLogs:
      type: object
      required:
        - type
        - textSecret
        - accountType
        - cronSchedule
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - openai_compliance_logs
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        apiKey:
          type: string
          title: API key
        textSecret:
          type: string
          title: API key (text secret)
          description: Select or create a stored text secret
        accountType:
          type: string
          title: Account type
          enum:
            - workspace
            - organization
          x-speakeasy-enum-descriptions:
            - Workspace
            - Organization
          x-speakeasy-unknown-values: allow
        cronSchedule:
          type: string
          title: Cron schedule
        earliest:
          type: string
          title: Earliest time
          description: "Relative to the current time. Format:
            [+|-]<time_integer><time_unit>"
        latest:
          type: string
          title: Latest time
          description: "Relative to the current time. Format:
            [+|-]<time_integer><time_unit>"
        jobTimeout:
          title: Job timeout
          type: string
          description: "Maximum time the job is allowed to run (examples: 30, 45s, 15m).
            Enter 0 for unlimited time."
          pattern: ^\d+[sm]?$
        logLevel:
          $ref: "#/components/schemas/LogLevelOptionsContentConfigItemsDebugError"
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of log file listing pages to retrieve per run. Set
            to 0 to retrieve all pages.
          minimum: 0
        stateTracking:
          type: boolean
          title: State tracking
          description: Track collection progress between consecutive scheduled executions
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout. Use 0 to disable.
          minimum: 0
          maximum: 2400
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        retryRules:
          $ref: "#/components/schemas/RetryRulesType"
        description:
          type: string
          title: Description
        workspaceId:
          type: string
          title: Workspace ID
          description: The ID of the ChatGPT workspace to collect logs from (UUID format)
        workspaceEventTypes:
          type: array
          title: Event types
          description: One or more compliance log categories to collect
          items:
            type: string
          uniqueItems: true
        organizationId:
          type: string
          title: Organization ID
          description: "The ID of the OpenAI API Platform Organization (example:
            org-XXXXXXXXXXXXXXXXXXXXXXXX)"
        organizationEventTypes:
          type: array
          title: Event types
          description: One or more compliance log categories to collect
          items:
            type: string
          uniqueItems: true
        stateUpdateExpression:
          type: string
          title: State update expression
          description: JavaScript expression that defines how to update the state from an
            event. Use the event's data and the current state to compute the new
            state. See [Understanding State Expression
            Fields](https://docs.cribl.io/stream/collectors-rest#state-tracking-expression-fields)
            for more information.
        stateMergeExpression:
          type: string
          title: State merge expression
          description: JavaScript expression that defines which state to keep when merging
            a task's newly reported state with previously saved state. Evaluates
            `prevState` and `newState` variables, resolving to the state to
            keep.
        manageState:
          type: object
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_workspaceId:
          type: string
          description: Binds 'workspaceId' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'workspaceId' at runtime.
        __template_organizationId:
          type: string
          description: Binds 'organizationId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'organizationId' at
            runtime.
    InputAnthropicCompliance:
      type: object
      required:
        - type
        - textSecret
        - contentConfig
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - anthropic_compliance
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        apiKey:
          type: string
          title: API key
        textSecret:
          type: string
          title: API key (text secret)
          description: Select or create a stored Anthropic API key
        contentConfig:
          type: array
          title: Endpoint types
          items:
            type: object
            required:
              - contentType
              - cronSchedule
              - earliest
              - latest
            properties:
              contentType:
                type: string
                title: Endpoint name
                pattern: ^[a-zA-Z0-9_-\s]+$
              contentDescription:
                type: string
                title: Description
              enabled:
                type: boolean
                title: Enable endpoint
              stateTracking:
                type: boolean
                title: State tracking
                description: Track collection progress between consecutive scheduled executions
              stateUpdateExpression:
                type: string
                title: State update expression
                description: JavaScript expression that defines how to update the state from an
                  event
              stateMergeExpression:
                type: string
                title: State merge expression
                description: JavaScript expression that defines which state to keep when merging
                  task state
              manageState:
                type: object
              cronSchedule:
                type: string
                title: Cron schedule
                description: Schedule on which to run this collection job
              earliest:
                type: string
                title: Earliest
                description: Earliest time for data collection, relative to now
              latest:
                type: string
                title: Latest
                description: Latest time for data collection, relative to now
              jobTimeout:
                title: Job timeout
                type: string
                description: "Maximum time the job is allowed to run (examples: 30, 45s, 15m).
                  Enter 0 for unlimited time."
                pattern: ^\d+[sm]?$
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout. Use 0 to disable.
          minimum: 0
          maximum: 2400
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        retryRules:
          $ref: "#/components/schemas/RetryRulesType"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    InputOkta:
      type: object
      required:
        - type
        - textSecret
        - oktaDomain
      properties:
        id:
          type: string
          title: Input ID
          description: Unique ID for this input
        type:
          type: string
          enum:
            - okta
        disabled:
          type: boolean
          title: Disabled
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data from this Source before sending it through
            the Routes
        sendToRoutes:
          type: boolean
          description: Select whether to send data to Routes, or directly to Destinations.
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        pqEnabled:
          type: boolean
          title: Enable persistent queue
          description: Use a disk queue to minimize data loss when connected services
            block. See [Cribl
            Docs](https://docs.cribl.io/stream/persistent-queues) for PQ
            defaults (Cribl-managed Cloud Workers) and configuration options
            (on-prem and hybrid Workers).
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        criblSourceProvenance:
          $ref: "#/components/schemas/InputCollectionOriginDataSourceDiscoveryWithDestina\
            tionArnConstraint"
        connections:
          type: array
          title: Use QuickConnect
          description: Direct connections to Destinations, and optionally via a Pipeline
            or a Pack
          items:
            $ref: "#/components/schemas/ConnectionConfInputCollection"
        pq:
          $ref: "#/components/schemas/PqType"
        oktaDomain:
          type: string
          title: Okta domain
          description: "Your Okta domain (example: your-org). Do not include .okta.com,
            https://, or trailing slashes."
        oktaToken:
          type: string
          title: Okta API token
          description: Your Okta API token for authentication
        textSecret:
          type: string
          title: Okta API token (text secret)
          description: Select or create a stored text secret
        cronSchedule:
          type: string
          title: Cron schedule
          description: Schedule on which to run this collection job
        earliest:
          type: string
          title: Earliest
          description: Earliest time for data collection, relative to now
        latest:
          type: string
          title: Latest
          description: Latest time for data collection, relative to now
        jobTimeout:
          type: string
          title: Job timeout
          description: Maximum time the job is allowed to run (e.g., 30, 45s or 15m).
            Units are seconds, if not specified. Enter 0 for unlimited time.
          pattern: ^\d+[sm]?$
        requestTimeout:
          type: number
          title: Request timeout (seconds)
          description: HTTP request inactivity timeout. Use 0 to disable.
          minimum: 0
          maximum: 2400
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often workers should check in with the scheduler to keep job
            subscription alive
          minimum: 10
        maxMissedKeepAlives:
          type: number
          title: Worker timeout (periods)
          description: The number of Keep Alive Time periods before an inactive worker
            will have its job subscription revoked.
          minimum: 2
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        retryRules:
          $ref: "#/components/schemas/RetryRulesType"
        description:
          type: string
          title: Description
        __template_environment:
          type: string
          description: Binds 'environment' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'environment' at runtime.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_oktaDomain:
          type: string
          description: Binds 'oktaDomain' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'oktaDomain' at runtime.
    Input:
      oneOf:
        - $ref: "#/components/schemas/InputCollection"
        - $ref: "#/components/schemas/InputKafka"
        - $ref: "#/components/schemas/InputMsk"
        - $ref: "#/components/schemas/InputHttp"
        - $ref: "#/components/schemas/InputSplunk"
        - $ref: "#/components/schemas/InputSplunkSearch"
        - $ref: "#/components/schemas/InputSplunkHec"
        - $ref: "#/components/schemas/InputAzureBlob"
        - $ref: "#/components/schemas/InputElastic"
        - $ref: "#/components/schemas/InputConfluentCloud"
        - $ref: "#/components/schemas/InputGrafana"
        - $ref: "#/components/schemas/InputLoki"
        - $ref: "#/components/schemas/InputPrometheusRw"
        - $ref: "#/components/schemas/InputPrometheus"
        - $ref: "#/components/schemas/InputEdgePrometheus"
        - $ref: "#/components/schemas/InputOffice365Mgmt"
        - $ref: "#/components/schemas/InputOffice365Service"
        - $ref: "#/components/schemas/InputOffice365MsgTrace"
        - $ref: "#/components/schemas/InputMicrosoftGraph"
        - $ref: "#/components/schemas/InputEventhub"
        - $ref: "#/components/schemas/InputEventhubAmqp"
        - $ref: "#/components/schemas/InputExec"
        - $ref: "#/components/schemas/InputFirehose"
        - $ref: "#/components/schemas/InputGooglePubsub"
        - $ref: "#/components/schemas/InputCribl"
        - $ref: "#/components/schemas/InputCriblTcp"
        - $ref: "#/components/schemas/InputCriblHttp"
        - $ref: "#/components/schemas/InputCriblLakeHttp"
        - $ref: "#/components/schemas/InputTcpjson"
        - $ref: "#/components/schemas/InputSystemMetrics"
        - $ref: "#/components/schemas/InputSystemState"
        - $ref: "#/components/schemas/InputKubeMetrics"
        - $ref: "#/components/schemas/InputKubeLogs"
        - $ref: "#/components/schemas/InputKubeEvents"
        - $ref: "#/components/schemas/InputWindowsMetrics"
        - $ref: "#/components/schemas/InputCrowdstrike"
        - $ref: "#/components/schemas/InputDatadogAgent"
        - $ref: "#/components/schemas/InputDatagen"
        - $ref: "#/components/schemas/InputHttpRaw"
        - $ref: "#/components/schemas/InputKinesis"
        - $ref: "#/components/schemas/InputCriblmetrics"
        - $ref: "#/components/schemas/InputMetrics"
        - $ref: "#/components/schemas/InputS3"
        - $ref: "#/components/schemas/InputS3Inventory"
        - $ref: "#/components/schemas/InputSnmp"
        - $ref: "#/components/schemas/InputOpenTelemetry"
        - $ref: "#/components/schemas/InputModelDrivenTelemetry"
        - $ref: "#/components/schemas/InputSqs"
        - $ref: "#/components/schemas/InputSyslog"
        - $ref: "#/components/schemas/InputFile"
        - $ref: "#/components/schemas/InputTcp"
        - $ref: "#/components/schemas/InputAppscope"
        - $ref: "#/components/schemas/InputWef"
        - $ref: "#/components/schemas/InputWinEventLogs"
        - $ref: "#/components/schemas/InputAppleUnifiedLogs"
        - $ref: "#/components/schemas/InputRawUdp"
        - $ref: "#/components/schemas/InputJournalFiles"
        - $ref: "#/components/schemas/InputWiz"
        - $ref: "#/components/schemas/InputOpenai"
        - $ref: "#/components/schemas/InputWizWebhook"
        - $ref: "#/components/schemas/InputNetflow"
        - $ref: "#/components/schemas/InputSecurityLake"
        - $ref: "#/components/schemas/InputServicenowTable"
        - $ref: "#/components/schemas/InputZscalerHec"
        - $ref: "#/components/schemas/InputCloudflareHec"
        - $ref: "#/components/schemas/InputOpenaiComplianceLogs"
        - $ref: "#/components/schemas/InputAnthropicCompliance"
        - $ref: "#/components/schemas/InputOkta"
      discriminator:
        propertyName: type
        mapping:
          collection: "#/components/schemas/InputCollection"
          kafka: "#/components/schemas/InputKafka"
          msk: "#/components/schemas/InputMsk"
          http: "#/components/schemas/InputHttp"
          splunk: "#/components/schemas/InputSplunk"
          splunk_search: "#/components/schemas/InputSplunkSearch"
          splunk_hec: "#/components/schemas/InputSplunkHec"
          azure_blob: "#/components/schemas/InputAzureBlob"
          elastic: "#/components/schemas/InputElastic"
          confluent_cloud: "#/components/schemas/InputConfluentCloud"
          grafana: "#/components/schemas/InputGrafana"
          loki: "#/components/schemas/InputLoki"
          prometheus_rw: "#/components/schemas/InputPrometheusRw"
          prometheus: "#/components/schemas/InputPrometheus"
          edge_prometheus: "#/components/schemas/InputEdgePrometheus"
          office365_mgmt: "#/components/schemas/InputOffice365Mgmt"
          office365_service: "#/components/schemas/InputOffice365Service"
          office365_msg_trace: "#/components/schemas/InputOffice365MsgTrace"
          microsoft_graph: "#/components/schemas/InputMicrosoftGraph"
          eventhub: "#/components/schemas/InputEventhub"
          eventhub_amqp: "#/components/schemas/InputEventhubAmqp"
          exec: "#/components/schemas/InputExec"
          firehose: "#/components/schemas/InputFirehose"
          google_pubsub: "#/components/schemas/InputGooglePubsub"
          cribl: "#/components/schemas/InputCribl"
          cribl_tcp: "#/components/schemas/InputCriblTcp"
          cribl_http: "#/components/schemas/InputCriblHttp"
          cribl_lake_http: "#/components/schemas/InputCriblLakeHttp"
          tcpjson: "#/components/schemas/InputTcpjson"
          system_metrics: "#/components/schemas/InputSystemMetrics"
          system_state: "#/components/schemas/InputSystemState"
          kube_metrics: "#/components/schemas/InputKubeMetrics"
          kube_logs: "#/components/schemas/InputKubeLogs"
          kube_events: "#/components/schemas/InputKubeEvents"
          windows_metrics: "#/components/schemas/InputWindowsMetrics"
          crowdstrike: "#/components/schemas/InputCrowdstrike"
          datadog_agent: "#/components/schemas/InputDatadogAgent"
          datagen: "#/components/schemas/InputDatagen"
          http_raw: "#/components/schemas/InputHttpRaw"
          kinesis: "#/components/schemas/InputKinesis"
          criblmetrics: "#/components/schemas/InputCriblmetrics"
          metrics: "#/components/schemas/InputMetrics"
          s3: "#/components/schemas/InputS3"
          s3_inventory: "#/components/schemas/InputS3Inventory"
          snmp: "#/components/schemas/InputSnmp"
          open_telemetry: "#/components/schemas/InputOpenTelemetry"
          model_driven_telemetry: "#/components/schemas/InputModelDrivenTelemetry"
          sqs: "#/components/schemas/InputSqs"
          syslog: "#/components/schemas/InputSyslog"
          file: "#/components/schemas/InputFile"
          tcp: "#/components/schemas/InputTcp"
          appscope: "#/components/schemas/InputAppscope"
          wef: "#/components/schemas/InputWef"
          win_event_logs: "#/components/schemas/InputWinEventLogs"
          apple_unified_logs: "#/components/schemas/InputAppleUnifiedLogs"
          raw_udp: "#/components/schemas/InputRawUdp"
          journal_files: "#/components/schemas/InputJournalFiles"
          wiz: "#/components/schemas/InputWiz"
          openai: "#/components/schemas/InputOpenai"
          wiz_webhook: "#/components/schemas/InputWizWebhook"
          netflow: "#/components/schemas/InputNetflow"
          security_lake: "#/components/schemas/InputSecurityLake"
          servicenow_table: "#/components/schemas/InputServicenowTable"
          zscaler_hec: "#/components/schemas/InputZscalerHec"
          cloudflare_hec: "#/components/schemas/InputCloudflareHec"
          openai_compliance_logs: "#/components/schemas/InputOpenaiComplianceLogs"
          anthropic_compliance: "#/components/schemas/InputAnthropicCompliance"
          okta: "#/components/schemas/InputOkta"
    CountedInput:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Input"
    CountedInputSplunkHec:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/InputSplunkHec"
    AddHecTokenRequest:
      type: object
      properties:
        allowedIndexesAtToken:
          type: array
          items:
            type: string
          description: List of index names that the HEC token is allowed to write to.
        description:
          type: string
          description: Brief description for the HEC token.
        enabled:
          type: boolean
          description: If <code>true</code>, the HEC token is enabled. Otherwise,
            <code>false</code>.
        metadata:
          type: array
          items:
            $ref: "#/components/schemas/EventBreakerRuleFields"
          description: Array of key-value pairs to associate with the HEC token for
            tagging, categorization, or providing additional context. Each item
            in the array is an object with a <code>name</code> and a
            <code>value</code>.
        token:
          type: string
          description: The HEC token value to add to the Splunk HEC Source.
      required:
        - token
    CountedObject:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            type: object
            additionalProperties: true
    CountedString:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            type: string
    CountedJobInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/JobInfo"
    RunnableJobCollection:
      required:
        - collector
        - run
      properties:
        id:
          type: string
          title: Job ID
          pattern: ^[a-zA-Z0-9_-]+$
          description: Unique ID for this Job
        description:
          type: string
          title: Description
        type:
          $ref: "#/components/schemas/JobTypeOptionsRunnableJobCollection"
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        removeFields:
          type: array
          title: Remove Discover fields
          description: List of fields to remove from Discover results. Wildcards (for
            example, aws*) are allowed. This is useful when discovery returns
            sensitive fields that should not be exposed in the Jobs user
            interface.
          minItems: 0
          items:
            type: string
            title: Items
            description: List of fields to remove from Discover results
        resumeOnBoot:
          type: boolean
          title: Resume job on boot
          description: Resume the ad hoc job if a failure condition causes Stream to
            restart during job execution
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        schedule:
          $ref: "#/components/schemas/ScheduleTypeRunnableJobCollection"
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        workerAffinity:
          type: boolean
          title: Worker affinity
          description: If enabled, tasks are created and run by the same Worker Node
        collector:
          $ref: "#/components/schemas/Collector"
        input:
          $ref: "#/components/schemas/RunnableJobCollectionTypeCollectionWithBreakerRules\
            etsConstraint"
        run:
          type: object
          required:
            - mode
          properties:
            rescheduleDroppedTasks:
              type: boolean
              title: Reschedule tasks
              description: Reschedule tasks that failed with non-fatal errors
            maxTaskReschedule:
              type: number
              title: Task reschedule limit
              description: Maximum number of times a task can be rescheduled
              minimum: 1
            logLevel:
              $ref: "#/components/schemas/LogLevelOptionsRunnableJobCollectionScheduleRun"
            jobTimeout:
              title: Job timeout
              type: string
              description: "Maximum time the job is allowed to run. Time unit defaults to
                seconds if not specified (examples: 30, 45s, 15m). Enter 0 for
                unlimited time."
              pattern: \d+[sm]?$
            mode:
              type: string
              title: Mode
              description: Job run mode. Preview will either return up to N matching results,
                or will run until capture time T is reached. Discovery will
                gather the list of files to turn into streaming tasks, without
                running the data collection job. Full Run will run the
                collection job.
              enum:
                - list
                - preview
                - run
              x-speakeasy-unknown-values: allow
            timeRangeType:
              type: string
              title: Time range
              enum:
                - absolute
                - relative
              x-speakeasy-unknown-values: allow
            earliest:
              type:
                - number
                - string
              title: Earliest
              description: Earliest time to collect data for the selected timezone
            latest:
              type:
                - number
                - string
              title: Latest
              description: Latest time to collect data for the selected timezone
            timestampTimezone:
              type: string
              title: Range timezone
              description: Timezone to use for Earliest and Latest times
            timeWarning:
              $ref: "#/components/schemas/BrokenEventProcessor"
            expression:
              type: string
              title: Filter
              description: A filter for tokens in the provided collect path and/or the events
                being collected
            minTaskSize:
              type: string
              title: Lower task bundle size
              description: >-
                Limits the bundle size for small tasks. For example,
                        if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task.
              pattern: ^((\d*\.?\d+)((KB|MB|GB|TB|PB|EB|ZB|YB|kb|mb|gb|tb|pb|eb|zb|yb){1}))$
            maxTaskSize:
              type: string
              title: Upper task bundle size
              description: >-
                Limits the bundle size for files above the lower task bundle
                size. For example, if your upper bundle size is 10MB,
                        you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks.
              pattern: ^((\d*\.?\d+)((KB|MB|GB|TB|PB|EB|ZB|YB|kb|mb|gb|tb|pb|eb|zb|yb){1}))$
            discoverToRoutes:
              type: boolean
              title: Send to Routes
              description: Send discover results to Routes
            capture:
              type: object
              title: Capture Settings
              properties:
                duration:
                  type: number
                  title: Capture time (sec)
                  description: Amount of time to keep capture open, in seconds
                  minimum: 1
                maxEvents:
                  type: number
                  title: Capture up to N events
                  description: Maximum number of events to capture
                  minimum: 1
                  maximum: 10000
                level:
                  type: integer
                  title: Where to capture
                  enum:
                    - 0
                    - 1
                    - 2
                    - 3
                  x-speakeasy-enum-descriptions:
                    - 1. Before pre-processing Pipeline
                    - 2. Before the Routes
                    - 3. Before post-processing Pipeline
                    - 4. Before the Destination
                  x-speakeasy-unknown-values: allow
                  x-speakeasy-enums:
                    - BeforePreProcessingPipeline
                    - BeforeTheRoutes
                    - BeforePostProcessingPipeline
                    - BeforeTheDestination
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      type: object
    RunnableJobExecutor:
      required:
        - executor
        - run
      properties:
        id:
          type: string
          title: Job ID
          pattern: ^[a-zA-Z0-9_-]+$
          description: Unique ID for this Job
        description:
          type: string
          title: Description
        type:
          $ref: "#/components/schemas/JobTypeOptionsRunnableJobCollection"
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        removeFields:
          type: array
          title: Remove Discover fields
          description: List of fields to remove from Discover results. Wildcards (for
            example, aws*) are allowed. This is useful when discovery returns
            sensitive fields that should not be exposed in the Jobs user
            interface.
          minItems: 0
          items:
            type: string
            title: Items
            description: List of fields to remove from Discover results
        resumeOnBoot:
          type: boolean
          title: Resume job on boot
          description: Resume the ad hoc job if a failure condition causes Stream to
            restart during job execution
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        schedule:
          $ref: "#/components/schemas/ScheduleTypeRunnableJobCollection"
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        executor:
          $ref: "#/components/schemas/ExecutorTypeRunnableJobExecutor"
        run:
          type: object
          properties:
            rescheduleDroppedTasks:
              type: boolean
              title: Reschedule tasks
              description: Reschedule tasks that failed with non-fatal errors
            maxTaskReschedule:
              type: number
              title: Task reschedule limit
              description: Maximum number of times a task can be rescheduled
              minimum: 1
            logLevel:
              $ref: "#/components/schemas/LogLevelOptionsRunnableJobCollectionScheduleRun"
            jobTimeout:
              title: Job timeout
              type: string
              description: "Maximum time the job is allowed to run. Time unit defaults to
                seconds if not specified (examples: 30, 45s, 15m). Enter 0 for
                unlimited time."
              pattern: \d+[sm]?$
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      type: object
    RunnableJobScheduledSearch:
      required:
        - savedQueryId
        - type
      properties:
        id:
          type: string
          title: Job ID
          pattern: ^[a-zA-Z0-9_-]+$
          description: Unique ID for this Job
        description:
          type: string
          title: Description
        type:
          $ref: "#/components/schemas/JobTypeOptionsRunnableJobCollection"
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        removeFields:
          type: array
          title: Remove Discover fields
          description: List of fields to remove from Discover results. Wildcards (for
            example, aws*) are allowed. This is useful when discovery returns
            sensitive fields that should not be exposed in the Jobs user
            interface.
          minItems: 0
          items:
            type: string
            title: Items
            description: List of fields to remove from Discover results
        resumeOnBoot:
          type: boolean
          title: Resume job on boot
          description: Resume the ad hoc job if a failure condition causes Stream to
            restart during job execution
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        schedule:
          $ref: "#/components/schemas/ScheduleTypeRunnableJobCollection"
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        savedQueryId:
          type: string
          title: ID of the SavedQuery
          description: Identifies which search query to run
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      type: object
    RunnableJob:
      oneOf:
        - $ref: "#/components/schemas/RunnableJobCollection"
        - $ref: "#/components/schemas/RunnableJobExecutor"
        - $ref: "#/components/schemas/RunnableJobScheduledSearch"
    TaskErrorInfo:
      type: object
      additionalProperties: true
      properties:
        message:
          type: string
          description: Human-readable error message.
        name:
          type: string
          description: Error name, if available.
        stack:
          type: string
          description: Truncated stack trace of the error.
      required:
        - message
      description: Serialized error object that describes why a job entered its
        current <code>state</code>. Includes <code>message</code> and may
        include a nested <code>reason</code> for wrapped errors.
    TaskErrorDetail:
      type: object
      properties:
        message:
          type: string
          description: Human-readable error message.
        name:
          type: string
          description: Error name, if available.
        reason:
          $ref: "#/components/schemas/TaskErrorInfo"
          description: Nested cause of the error, if any.
        stack:
          type: string
          description: Truncated stack trace of the error.
      required:
        - message
      description: Task error details. May include a nested <code>reason</code> for
        wrapped errors and additional properties from the original error.
    JobStatus:
      type: object
      properties:
        reason:
          $ref: "#/components/schemas/TaskErrorDetail"
          description: Reason the job entered its current <code>state</code>, typically
            populated upon failure. May include a nested <code>reason</code> for
            wrapped errors.
        state:
          type: integer
          description: State of the Job
          enum:
            - 0
            - 1
            - 2
            - 3
            - 4
            - 5
            - 6
            - 7
            - 8
            - 9
          x-speakeasy-enums:
            - Initializing
            - Pending
            - Running
            - Paused
            - Cancelled
            - Finished
            - Failed
            - Orphaned
            - Unknown
            - Length
          x-speakeasy-unknown-values: allow
      required:
        - state
      description: Status of a job, including its current state and failure reason.
    JobInfo:
      type: object
      properties:
        args:
          $ref: "#/components/schemas/RunnableJob"
          description: Configuration and run settings used to launch the job.
        id:
          type: string
          description: Unique identifier for the job.
        keep:
          type: boolean
          description: If <code>true</code>, retain the job and its artifacts instead of
            deleting according to the time-to-live or retention policy. The job
            persists until it is manually deleted.
        stats:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeJobInfoStats"
          description: Counters and metrics collected during job execution.
        status:
          $ref: "#/components/schemas/JobStatus"
          description: Status of the job.
      required:
        - args
        - id
        - stats
        - status
      description: Detailed information about a job, including its configuration,
        status, and statistics.
    CountedInputResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/InputResponse"
    Provenance:
      type: object
      properties:
        destinationArn:
          type: string
        origin:
          type: string
          const: data_source_discovery
        sourceArn:
          type: string
      required:
        - origin
    Notification:
      type: object
      required:
        - id
        - condition
      properties:
        id:
          type: string
          title: ID
          pattern: ^[a-zA-Z0-9_-]+$
          description: Unique identifier for the Notification.
        disabled:
          type: boolean
          title: Disabled
          description: If true, the Notification is disabled and the specified condition
            will not trigger it.
        condition:
          type: string
          title: Condition
          description: The condition that triggers the Notification.
        targets:
          type: array
          title: Notification targets
          description: List of the IDs for the Notification targets to send the
            Notification to.
          items:
            type: string
        targetConfigs:
          type: array
          title: Target configuration
          description: Override settings to apply for each referenced Notification target.
          items:
            type: object
            required:
              - id
            properties:
              id:
                type: string
                title: Notification target ID
                pattern: ^[a-zA-Z0-9_-]+$
            anyOf:
              - properties:
                  conf:
                    type: object
                    title: Notification config for SMTP target
                    properties:
                      subject:
                        type: string
                        title: Subject
                        description: Email subject
                      body:
                        type: string
                        title: Message
                        description: Email body
                      emailRecipient:
                        type: object
                        required:
                          - to
                        properties:
                          to:
                            type: string
                            title: To
                            description: Recipients' email addresses
                          cc:
                            type: string
                            title: Cc
                            description: "Cc: Recipients' email addresses"
                          bcc:
                            type: string
                            title: Bcc
                            description: "Bcc: Recipients' email addresses"
        conf:
          type: object
          title: Condition-specific configurations
          description: Configuration for the condition that triggers the Notification.
            Supported fields vary depending on the condition.
          properties: {}
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        group:
          type: string
          title: Worker Group/Fleet
          description: The worker group/fleet this notification belongs to
        pack:
          type: string
          title: Pack
          description: The pack this notification belongs to
        mode:
          type: string
          title: Mode
          description: "Notification mode: direct or policy-based"
          enum:
            - direct
            - policy
          x-speakeasy-unknown-values: allow
        templateTargetPairs:
          type: array
          title: Template & Target Pairs
          description: Pairs of templates and targets for notification routing
          items:
            $ref: "#/components/schemas/TemplateTargetPairConfFunctionConfSchemaNotificatio\
              nPolicies"
      oneOf:
        - properties:
            mode:
              const: direct
            templateTargetPairs:
              minItems: 1
          required:
            - mode
            - templateTargetPairs
        - properties:
            mode:
              const: policy
            templateTargetPairs:
              maxItems: 0
          required:
            - mode
        - properties:
            mode: {}
    StatusError:
      type: object
      properties:
        details:
          type: object
          additionalProperties: true
          description: Additional error details.
        message:
          type: string
          description: Human-readable message that describes the error.
      required:
        - message
    HealthStringType:
      type: string
      enum:
        - Green
        - Yellow
        - Red
        - Unknown
      x-speakeasy-unknown-values: allow
    WorkerPQStatus:
      type: object
      properties:
        error:
          $ref: "#/components/schemas/StatusError"
        health:
          type: number
        metrics:
          type: object
          additionalProperties: true
        timestamp:
          type: number
      required:
        - health
        - metrics
        - timestamp
    InputResponse:
      allOf:
        - $ref: "#/components/schemas/Input"
        - type: object
          properties:
            notifications:
              type: array
              items:
                $ref: "#/components/schemas/Notification"
              description: Notifications attached to the Source.
            status:
              $ref: "#/components/schemas/StatusType"
      description: Source configuration with optional Notifications and runtime status.
    SourceType:
      type: array
      items:
        type: string
    UpdateHecTokenRequest:
      type: object
      properties:
        allowedIndexesAtToken:
          type: array
          items:
            type: string
          description: List of index names that the HEC token is allowed to write to.
        description:
          type: string
          description: Brief description for the HEC token.
        enabled:
          type: boolean
          description: If <code>true</code>, the HEC token is enabled. Otherwise,
            <code>false</code>.
        metadata:
          type: array
          items:
            $ref: "#/components/schemas/EventBreakerRuleFields"
          description: Array of key-value pairs to associate with the HEC token for
            tagging, categorization, or providing additional context. Each item
            in the array is an object with a <code>name</code> and a
            <code>value</code>.
    IoMetricsEntryLevel:
      type: string
      enum:
        - minimal
        - basic
        - detailed
        - comprehensive
      x-speakeasy-unknown-values: allow
    IoMetricsEntry:
      type: object
      properties:
        canDelete:
          type: boolean
        id:
          type: string
        level:
          $ref: "#/components/schemas/IoMetricsEntryLevel"
      required:
        - id
        - level
    CountedIoMetricsEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/IoMetricsEntry"
    OutputDefault:
      type: object
      required:
        - type
        - defaultId
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - default
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        defaultId:
          type:
            - string
            - "null"
          title: Default Output ID
          description: ID of the default output. This will be used whenever a
            nonexistent/deleted output is referenced.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    OutputWebhook:
      type: object
      required:
        - type
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - webhook
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        method:
          $ref: "#/components/schemas/MethodOptions"
        format:
          type: string
          title: Format
          description: How to format events before sending out
          enum:
            - ndjson
            - json_array
            - custom
            - advanced
          x-speakeasy-enum-descriptions:
            - NDJSON (Newline Delimited JSON)
            - JSON Array
            - Custom
            - Advanced
          x-speakeasy-unknown-values: allow
        keepAlive:
          type: boolean
          title: Keep alive
          description: Disable to close the connection immediately after sending the
            outgoing request
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 512000
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events. You can also add headers dynamically
            on a per-event basis in the __headers field, as explained in [Cribl
            Docs](https://docs.cribl.io/stream/destinations-webhook/#internal-fields).
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          type: string
          title: Authentication type
          description: Authentication method to use for the HTTP request
          enum:
            - none
            - basic
            - credentialsSecret
            - token
            - textSecret
            - oauth
          x-speakeasy-enum-descriptions:
            - None
            - Basic
            - Basic (credentials secret)
            - Token
            - Token (text secret)
            - OAuth
          x-speakeasy-unknown-values: allow
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPathExtended"
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        loadBalanced:
          type: boolean
          title: Load balancing
          description: Enable for optimal performance. Even if you have one hostname, it
            can expand to multiple IPs. If disabled, consider enabling
            round-robin DNS.
        description:
          type: string
          title: Description
        customSourceExpression:
          type: string
          title: Source expression
          description: "Expression to evaluate on events to generate output. Example:
            `raw=${_raw}`. See [Cribl
            Docs](https://docs.cribl.io/stream/destinations-webhook#custom-form\
            at) for other examples. If empty, the full event is sent as
            stringified JSON."
        customDropWhenNull:
          type: boolean
          title: Drop when null
          description: Whether to drop events when the source expression evaluates to null
        customEventDelimiter:
          type: string
          title: Event delimiter
          description: Delimiter string to insert between individual events. Defaults to
            newline character.
        customContentType:
          type: string
          title: Content type
          description: Content type to use for request. Defaults to application/x-ndjson.
            Any content types set in Advanced Settings > Extra HTTP headers will
            override this entry.
        customPayloadExpression:
          type: string
          title: Batch expression
          description: 'Expression specifying how to format the payload for each batch. To
            reference the events to send, use the `${events}` variable. Example
            expression: `{ "items" : [${events}] }` would send the batch inside
            a JSON object.'
        advancedContentType:
          type: string
          title: Content type
          description: HTTP content-type header value
        formatEventCode:
          type: string
          title: Format inbound event
          description: "Custom JavaScript code to format incoming event data accessible
            through the __e variable. The formatted content is added to
            (__e['__eventOut']) if available. Otherwise, the original event is
            serialized as JSON. Caution: This function is evaluated in an
            unprotected context, allowing you to execute almost any JavaScript
            code."
        formatPayloadCode:
          type: string
          title: Format outbound payload
          description: "Optional JavaScript code to format the payload sent to the
            Destination. The payload, containing a batch of formatted events, is
            accessible through the __e['payload'] variable. The formatted
            payload is returned in the __e['__payloadOut'] variable. Caution:
            This function is evaluated in an unprotected context, allowing you
            to execute almost any JavaScript code."
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        token:
          type: string
          title: Token
          description: Bearer token to include in the authorization header
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        textSecret:
          type: string
          title: Token (text secret)
          description: Select or create a stored text secret
        loginUrl:
          type: string
          title: Login URL
          description: URL for OAuth
          pattern: ^https?://.*
        secretParamName:
          type: string
          title: OAuth Secret parameter name
          description: Secret parameter name to pass in request body
        secret:
          type: string
          title: OAuth secret
          description: Secret parameter value to pass in request body
        tokenAttributeName:
          type: string
          title: Token attribute name
          description: Name of the auth token attribute in the OAuth response. Can be
            top-level (e.g., 'token'); or nested, using a period (e.g.,
            'data.token').
        authHeaderExpr:
          type: string
          title: Authorize expression
          description: "JavaScript expression to compute the Authorization header value to
            pass in requests. The value `${token}` is used to reference the
            token obtained from authentication, e.g.: `Bearer ${token}`."
        tokenTimeoutSecs:
          type: number
          title: Refresh interval (secs.)
          description: How often the OAuth token should be refreshed.
          minimum: 1
          maximum: 300000
        oauthParams:
          type: array
          title: OAuth parameters
          description: Additional parameters to send in the OAuth login request.
            @{product} will combine the secret with these parameters, and will
            send the URL-encoded result in a POST request to the endpoint
            specified in the 'Login URL'. We'll automatically add the
            content-type header 'application/x-www-form-urlencoded' when sending
            this request.
          items:
            $ref: "#/components/schemas/OauthParamConfInputServicenowTable"
        oauthHeaders:
          type: array
          title: OAuth headers
          description: Additional headers to send in the OAuth login request. @{product}
            will automatically add the content-type header
            'application/x-www-form-urlencoded' when sending this request.
          items:
            $ref: "#/components/schemas/OauthHeaderConfInputServicenowTable"
        url:
          type: string
          title: Webhook URL
          description: URL of a webhook endpoint to send events to, such as
            http://localhost:10200
          pattern: ^https?://.*
        excludeSelf:
          type: boolean
          title: Exclude current host IPs
          description: Exclude all IPs of the current host from the list of any resolved
            hostnames
        urls:
          type: array
          title: Webhook URLs
          description: ""
          minItems: 1
          items:
            type: object
            required:
              - url
            properties:
              url:
                type: string
                title: Webhook LB URL
                description: URL of a webhook endpoint to send events to, such as
                  http://localhost:10200
                pattern: ^https?://.*
              weight:
                type: number
                title: Load Weight
                description: Assign a weight (>0) to each endpoint to indicate its
                  traffic-handling capability
                minimum: 0
              __template_url:
                type: string
                description: Binds 'url' to a variable for dynamic value resolution. Set to
                  variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                  (group-scoped). Variable value overrides 'url' at runtime.
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (seconds)
          description: The interval in which to re-resolve any hostnames and pick up
            destinations from A records
        loadBalanceStatsPeriodSec:
          type: number
          minimum: 10
          title: Load balance stats period (seconds)
          description: How far back in time to keep traffic stats for load balancing
            purposes
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
        __template_secret:
          type: string
          description: Binds 'secret' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'secret' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
      anyOf:
        - required:
            - url
        - required:
            - urls
    OutputSentinel:
      type: object
      required:
        - type
        - endpointURLConfiguration
        - loginUrl
        - secret
        - client_id
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - sentinel
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        keepAlive:
          type: boolean
          title: Keep alive
          description: Disable to close the connection immediately after sending the
            outgoing request
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size (KB) of the request body (defaults to the API's
            maximum limit of 1000 KB)
          minimum: 100
          maximum: 1000
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events. You can also add headers dynamically
            on a per-event basis in the __headers field, as explained in [Cribl
            Docs](https://docs.cribl.io/stream/destinations-webhook/#internal-fields).
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          enum:
            - oauth
          x-speakeasy-unknown-values: allow
        loginUrl:
          type: string
          title: Login URL
          description: URL for OAuth
          pattern: ^https?://.*
        secret:
          type: string
          title: OAuth secret
          description: Secret parameter value to pass in request body
        client_id:
          title: Client ID
          type: string
          description: JavaScript expression to compute the Client ID for the Azure
            application. Can be a constant.
        scope:
          title: Scope
          type: string
          description: Scope to pass in the OAuth request
        endpointURLConfiguration:
          title: Endpoint configuration
          description: Enter the data collection endpoint URL or the individual ID
          type: string
          enum:
            - url
            - ID
          x-speakeasy-enum-descriptions:
            - URL
            - ID
          x-speakeasy-unknown-values: allow
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        description:
          type: string
          title: Description
        format:
          enum:
            - ndjson
            - json_array
            - custom
            - advanced
          x-speakeasy-unknown-values: allow
        customSourceExpression:
          type: string
          title: Source expression
          description: "Expression to evaluate on events to generate output. Example:
            `raw=${_raw}`. See [Cribl
            Docs](https://docs.cribl.io/stream/destinations-webhook#custom-form\
            at) for other examples. If empty, the full event is sent as
            stringified JSON."
        customDropWhenNull:
          type: boolean
          title: Drop when null
          description: Whether to drop events when the source expression evaluates to null
        customEventDelimiter:
          type: string
          title: Event delimiter
          description: Delimiter string to insert between individual events. Defaults to
            newline character.
        customContentType:
          type: string
          title: Content type
          description: Content type to use for request. Defaults to application/x-ndjson.
            Any content types set in Advanced Settings > Extra HTTP headers will
            override this entry.
        customPayloadExpression:
          type: string
          title: Batch expression
          description: 'Expression specifying how to format the payload for each batch. To
            reference the events to send, use the `${events}` variable. Example
            expression: `{ "items" : [${events}] }` would send the batch inside
            a JSON object.'
        advancedContentType:
          type: string
          title: Content type
          description: HTTP content-type header value
        formatEventCode:
          type: string
          title: Format inbound event
          description: "Custom JavaScript code to format incoming event data accessible
            through the __e variable. The formatted content is added to
            (__e['__eventOut']) if available. Otherwise, the original event is
            serialized as JSON. Caution: This function is evaluated in an
            unprotected context, allowing you to execute almost any JavaScript
            code."
        formatPayloadCode:
          type: string
          title: Format outbound payload
          description: "Optional JavaScript code to format the payload sent to the
            Destination. The payload, containing a batch of formatted events, is
            accessible through the __e['payload'] variable. The formatted
            payload is returned in the __e['__payloadOut'] variable. Caution:
            This function is evaluated in an unprotected context, allowing you
            to execute almost any JavaScript code."
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        url:
          title: URL
          type: string
          description: URL to send events to. Can be overwritten by an event's __url field.
          pattern: ^https?://.*
        dcrID:
          type: string
          title: Data collection rule ID
          description: Immutable ID for the Data Collection Rule (DCR)
        dceEndpoint:
          type: string
          title: Data collection endpoint
          description: "Data collection endpoint (DCE) URL. In the format:
            `https://<Endpoint-Name>-<Identifier>.<Region>.ingest.monitor.azure\
            .com`"
          pattern: ^https:\/\/([a-zA-Z0-9-_\.]+)\.ingest\.monitor\.azure\.com(\/?)$
        streamName:
          type: string
          title: Stream name
          description: The name of the stream (Sentinel table) in which to store the events
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
        __template_secret:
          type: string
          description: Binds 'secret' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'secret' at runtime.
        __template_client_id:
          type: string
          description: Binds 'client_id' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'client_id' at runtime.
        __template_scope:
          type: string
          description: Binds 'scope' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'scope' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_dcrID:
          type: string
          description: Binds 'dcrID' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'dcrID' at runtime.
        __template_dceEndpoint:
          type: string
          description: Binds 'dceEndpoint' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'dceEndpoint' at runtime.
        __template_streamName:
          type: string
          description: Binds 'streamName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamName' at runtime.
    OutputDevnull:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - devnull
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    OutputSyslog:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - syslog
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        protocol:
          type: string
          title: Protocol
          description: The network protocol to use for sending out syslog messages
          enum:
            - tcp
            - udp
          x-speakeasy-enum-descriptions:
            - TCP
            - UDP
          x-speakeasy-unknown-values: allow
        facility:
          type: integer
          title: Facility
          description: Default value for message facility. Will be overwritten by value of
            __facility if set. Defaults to user.
          enum:
            - 0
            - 1
            - 2
            - 3
            - 4
            - 5
            - 6
            - 7
            - 8
            - 9
            - 10
            - 11
            - 12
            - 13
            - 14
            - 15
            - 16
            - 17
            - 18
            - 19
            - 20
            - 21
          x-speakeasy-enum-descriptions:
            - kern
            - user
            - mail
            - daemon
            - auth
            - syslog
            - lpr
            - news
            - uucp
            - cron
            - authpriv
            - ftp
            - ntp
            - security
            - console
            - solaris-cron
            - local0
            - local1
            - local2
            - local3
            - local4
            - local5
          x-speakeasy-unknown-values: allow
          x-speakeasy-enums:
            - Kern
            - User
            - Mail
            - Daemon
            - Auth
            - Syslog
            - Lpr
            - News
            - Uucp
            - Cron
            - Authpriv
            - Ftp
            - Ntp
            - Security
            - Console
            - SolarisCron
            - Local0
            - Local1
            - Local2
            - Local3
            - Local4
            - Local5
        severity:
          type: integer
          title: Severity
          description: Default value for message severity. Will be overwritten by value of
            __severity if set. Defaults to notice.
          enum:
            - 0
            - 1
            - 2
            - 3
            - 4
            - 5
            - 6
            - 7
          x-speakeasy-enum-descriptions:
            - emergency
            - alert
            - critical
            - error
            - warning
            - notice
            - info
            - debug
          x-speakeasy-unknown-values: allow
          x-speakeasy-enums:
            - Emergency
            - Alert
            - Critical
            - Error
            - Warning
            - Notice
            - Info
            - Debug
        appName:
          type: string
          title: App name
          description: Default name for device or application that originated the message.
            Defaults to Cribl, but will be overwritten by value of __appname if
            set.
        messageFormat:
          type: string
          enum:
            - rfc3164
            - rfc5424
          title: Message format
          description: The syslog message format depending on the receiver's support
          x-speakeasy-enum-descriptions:
            - RFC3164
            - RFC5424
          x-speakeasy-unknown-values: allow
        timestampFormat:
          type: string
          enum:
            - syslog
            - iso8601
          title: Timestamp format
          description: Timestamp format to use when serializing event's time field
          x-speakeasy-enum-descriptions:
            - Syslog
            - ISO8601
          x-speakeasy-unknown-values: allow
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        octetCountFraming:
          type: boolean
          title: Octet count framing
          description: Prefix messages with the byte count of the message. If disabled, no
            prefix will be set, and the message will be appended with a \n.
        logFailedRequests:
          type: boolean
          title: Log failed requests to disk
          description: Use to troubleshoot issues with sending data
        description:
          type: string
          title: Description
        loadBalanced:
          type: boolean
          title: Load balancing
          description: For optimal performance, enable load balancing even if you have one
            hostname, as it can expand to multiple IPs.  If this setting is
            disabled, consider enabling round-robin DNS.
        host:
          type: string
          title: Address
          description: The hostname of the receiver
        port:
          type: number
          title: Port
          maximum: 65535
          description: The port to connect to on the provided host
        excludeSelf:
          type: boolean
          title: Exclude current host IPs
          description: Exclude all IPs of the current host from the list of any resolved
            hostnames
        hosts:
          type: array
          title: Destinations
          description: Set of hosts to load-balance data to
          minItems: 1
          items:
            $ref: "#/components/schemas/HostConfOutputSyslog"
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (seconds)
          description: The interval in which to re-resolve any hostnames and pick up
            destinations from A records
        loadBalanceStatsPeriodSec:
          type: number
          minimum: 10
          title: Load balance stats period (seconds)
          description: How far back in time to keep traffic stats for load balancing
            purposes
        maxConcurrentSenders:
          type: number
          minimum: 0
          title: Connection limit
          description: Maximum number of concurrent connections (per Worker Process). A
            random set of IPs will be picked on every DNS resolution period. Use
            0 for unlimited.
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        writeTimeout:
          type: number
          title: Write timeout
          description: Amount of time (milliseconds) to wait for a write to complete
            before assuming connection is dead
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        maxRecordSize:
          type: number
          title: Record size limit
          minimum: 1
          maximum: 65535
          description: Maximum size of syslog messages. Make sure this value is less than
            or equal to the MTU to avoid UDP packet fragmentation.
        udpDnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (sec)
          description: How often to resolve the destination hostname to an IP address.
            Ignored if the destination is an IP address. A value of 0 means
            every message sent will incur a DNS lookup.
        enableIpSpoofing:
          title: Enable Source IP spoofing
          description: Send Syslog traffic using the original event's Source IP and port.
            To enable this, you must install the external `udp-sender` helper
            binary at `/usr/bin/udp-sender` on all Worker Nodes and grant it the
            `CAP_NET_RAW` capability.
          type: boolean
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
      required:
        - type
    OutputSplunk:
      type: object
      required:
        - type
        - host
        - port
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - splunk
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        host:
          type: string
          title: Address
          description: The hostname of the receiver
        port:
          type: number
          title: Port
          maximum: 65535
          description: The port to connect to on the provided host
        nestedFields:
          $ref: "#/components/schemas/NestedFieldSerializationOptions"
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        writeTimeout:
          type: number
          title: Write timeout
          description: Amount of time (milliseconds) to wait for a write to complete
            before assuming connection is dead
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        enableMultiMetrics:
          type: boolean
          title: Output multiple metrics
          description: Output metrics in multiple-metric format in a single event.
            Supported in Splunk 8.0 and above.
        enableACK:
          type: boolean
          title: Minimize in-flight data loss
          description: Check if indexer is shutting down and stop sending data. This helps
            minimize data loss during shutdown.
        logFailedRequests:
          type: boolean
          title: Log failed requests to disk
          description: Use to troubleshoot issues with sending data
        maxS2Sversion:
          $ref: "#/components/schemas/MaxS2SVersionOptions"
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        description:
          type: string
          title: Description
        maxFailedHealthChecks:
          type: number
          title: Failed health check limit
          description: Maximum number of times healthcheck can fail before we close
            connection. If set to 0 (disabled), and the connection to Splunk is
            forcibly closed, some data loss might occur.
          minimum: 0
        compress:
          $ref: "#/components/schemas/CompressionOptions"
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        authToken:
          type: string
          title: Auth token
          description: Shared secret token to use when establishing a connection to a
            Splunk indexer.
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
        __template_nestedFields:
          type: string
          description: Binds 'nestedFields' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'nestedFields' at runtime.
        __template_maxS2Sversion:
          type: string
          description: Binds 'maxS2Sversion' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'maxS2Sversion' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
    OutputSplunkLb:
      type: object
      required:
        - type
        - hosts
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - splunk_lb
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (seconds)
          description: The interval in which to re-resolve any hostnames and pick up
            destinations from A records
        loadBalanceStatsPeriodSec:
          type: number
          minimum: 10
          title: Load balance stats period (seconds)
          description: How far back in time to keep traffic stats for load balancing
            purposes
        maxConcurrentSenders:
          type: number
          minimum: 0
          title: Connection limit
          description: Maximum number of concurrent connections (per Worker Process). A
            random set of IPs will be picked on every DNS resolution period. Use
            0 for unlimited.
        nestedFields:
          $ref: "#/components/schemas/NestedFieldSerializationOptions"
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        writeTimeout:
          type: number
          title: Write timeout
          description: Amount of time (milliseconds) to wait for a write to complete
            before assuming connection is dead
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        enableMultiMetrics:
          type: boolean
          title: Output multiple metrics
          description: Output metrics in multiple-metric format in a single event.
            Supported in Splunk 8.0 and above.
        enableACK:
          type: boolean
          title: Minimize in-flight data loss
          description: Check if indexer is shutting down and stop sending data. This helps
            minimize data loss during shutdown.
        logFailedRequests:
          type: boolean
          title: Log failed requests to disk
          description: Use to troubleshoot issues with sending data
        maxS2Sversion:
          $ref: "#/components/schemas/MaxS2SVersionOptions"
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        indexerDiscovery:
          type: boolean
          title: Indexer Discovery
          description: Automatically discover indexers in indexer clustering environment.
        senderUnhealthyTimeAllowance:
          type: number
          title: Endpoint health fluctuation time allowance (ms)
          description: How long (in milliseconds) each LB endpoint can report blocked
            before the Destination reports unhealthy, blocking the sender.
            (Grace period for fluctuations.) Use 0 to disable; max 1 minute.
          minimum: 0
          maximum: 60000
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        description:
          type: string
          title: Description
        maxFailedHealthChecks:
          type: number
          title: Failed health check limit
          description: Maximum number of times healthcheck can fail before we close
            connection. If set to 0 (disabled), and the connection to Splunk is
            forcibly closed, some data loss might occur.
          minimum: 0
        compress:
          $ref: "#/components/schemas/CompressionOptions"
        indexerDiscoveryConfigs:
          type: object
          description: List of configurations to set up indexer discovery in Splunk
            Indexer clustering environment.
          required:
            - masterUri
            - site
            - refreshIntervalSec
          properties:
            site:
              type: string
              pattern: "[0-9A-Za-z-._]+"
              title: Site
              description: Clustering site of the indexers from where indexers need to be
                discovered. In case of single site cluster, it defaults to
                'default' site.
            masterUri:
              type: string
              pattern: ^https?://[a-zA-Z0-9-._]+:[0-9]+$
              title: Cluster manager URI
              description: "Full URI of Splunk cluster manager (scheme://host:port). Example:
                https://managerAddress:8089"
            refreshIntervalSec:
              type: number
              minimum: 60
              maximum: 86400
              title: Refresh period
              description: Time interval, in seconds, between two consecutive indexer list
                fetches from cluster manager
            rejectUnauthorized:
              type: boolean
              title: Validate cluster manager certificates
              description: During indexer discovery, reject cluster manager certificates that
                are not authorized by the system's CA. Disable to allow
                untrusted (for example, self-signed) certificates.
            authTokens:
              type: array
              title: Authentication tokens
              description: Tokens required to authenticate to cluster manager for indexer
                discovery
              items:
                type: object
                properties:
                  authType:
                    $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
                  authToken:
                    type: string
                    title: Auth token
                    description: Shared secret to be provided by any client (in authToken header
                      field). If empty, unauthorized access is permitted.
                  textSecret:
                    type: string
                    title: Auth token (text secret)
                    description: Select or create a stored text secret
            authType:
              $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
            authToken:
              type: string
              title: Auth token
              description: Shared secret to be provided by any client (in authToken header
                field). If empty, unauthorized access is permitted.
            textSecret:
              type: string
              title: Auth token (text secret)
              description: Select or create a stored text secret
        excludeSelf:
          type: boolean
          title: Exclude current host IPs
          description: Exclude all IPs of the current host from the list of any resolved
            hostnames
        hosts:
          type: array
          title: Destinations
          description: Set of Splunk indexers to load-balance data to.
          minItems: 1
          items:
            $ref: "#/components/schemas/HostConfOutputSyslog"
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        authToken:
          type: string
          title: Auth token
          description: Shared secret token to use when establishing a connection to a
            Splunk indexer.
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_nestedFields:
          type: string
          description: Binds 'nestedFields' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'nestedFields' at runtime.
        __template_maxS2Sversion:
          type: string
          description: Binds 'maxS2Sversion' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'maxS2Sversion' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
    OutputSplunkHec:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - splunk_hec
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        loadBalanced:
          type: boolean
          title: Load balancing
          description: Enable for optimal performance. Even if you have one hostname, it
            can expand to multiple IPs. If disabled, consider enabling
            round-robin DNS.
        nextQueue:
          type: string
          title: Next Processing Queue
          description: In the Splunk app, define which Splunk processing queue to send the
            events after HEC processing.
        tcpRouting:
          type: string
          title: Default _TCP_ROUTING
          description: In the Splunk app, set the value of _TCP_ROUTING for events that do
            not have _ctrl._TCP_ROUTING set.
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPathExtended"
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 2097152
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        enableMultiMetrics:
          type: boolean
          title: Output multi-metrics
          description: Output metrics in multiple-metric format, supported in Splunk 8.0
            and above to allow multiple metrics in a single event.
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        url:
          type: string
          title: Splunk HEC Endpoint
          description: URL to a Splunk HEC endpoint to send events to, e.g.,
            http://localhost:8088/services/collector/event
          pattern: ^https?://.*
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        excludeSelf:
          type: boolean
          title: Exclude current host IPs
          description: Exclude all IPs of the current host from the list of any resolved
            hostnames
        urls:
          type: array
          title: Splunk HEC Endpoints
          description: ""
          minItems: 1
          items:
            type: object
            required:
              - url
            properties:
              url:
                type: string
                title: HEC Endpoint
                description: URL to a Splunk HEC endpoint to send events to, e.g.,
                  http://localhost:8088/services/collector/event
                pattern: ^https?://.*
              weight:
                type: number
                title: Load Weight
                description: Assign a weight (>0) to each endpoint to indicate its
                  traffic-handling capability
                minimum: 0
              __template_url:
                type: string
                description: Binds 'url' to a variable for dynamic value resolution. Set to
                  variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                  (group-scoped). Variable value overrides 'url' at runtime.
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (seconds)
          description: The interval in which to re-resolve any hostnames and pick up
            destinations from A records
        loadBalanceStatsPeriodSec:
          type: number
          minimum: 10
          title: Load balance stats period (seconds)
          description: How far back in time to keep traffic stats for load balancing
            purposes
        token:
          type: string
          title: HEC Auth token
          description: Splunk HEC authentication token
        textSecret:
          type: string
          title: HEC Auth token (text secret)
          description: Select or create a stored text secret
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
      required:
        - type
    OutputWizHec:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - wiz_hec
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        nextQueue:
          type: string
          title: Next Processing Queue
          description: In the Splunk app, define which Splunk processing queue to send the
            events after HEC processing.
        tcpRouting:
          type: string
          title: Default _TCP_ROUTING
          description: In the Splunk app, set the value of _TCP_ROUTING for events that do
            not have _ctrl._TCP_ROUTING set.
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPathExtended"
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 9000
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        wiz_connector_id:
          type: string
          title: Wiz Connector ID
          description: The unique identifier for the specific Cribl connector defined in
            your Wiz Settings. This is used to cross-validate the bearer token
            and ensure traffic is originating from the authorized integration.
        wiz_environment:
          type: string
          title: Wiz Environment
          description: Your Wiz deployment environment.
        data_center:
          type: string
          title: Wiz Data Center
          description: Your Wiz deployment data center (e.g., us1, us8, eu1). From Tenant
            Info → Data Center and Regions → Tenant Data Center in your Wiz
            console.
        wiz_sourcetype:
          type: string
          title: Wiz Defend Source Type
          description: ""
        description:
          type: string
          title: Description
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        token:
          type: string
          title: Authentication token
          description: Wiz Defend Auth token
        textSecret:
          type: string
          title: Authentication token (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_wiz_environment:
          type: string
          description: Binds 'wiz_environment' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'wiz_environment' at
            runtime.
        __template_data_center:
          type: string
          description: Binds 'data_center' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'data_center' at runtime.
        __template_wiz_sourcetype:
          type: string
          description: Binds 'wiz_sourcetype' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'wiz_sourcetype' at
            runtime.
      required:
        - type
        - wiz_connector_id
        - wiz_environment
        - data_center
        - wiz_sourcetype
    OutputTcpjson:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - tcpjson
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        loadBalanced:
          type: boolean
          title: Load balancing
          description: Use load-balanced destinations
        compression:
          $ref: "#/components/schemas/CompressionOptionsGzipNone"
        logFailedRequests:
          type: boolean
          title: Log failed requests to disk
          description: Use to troubleshoot issues with sending data
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        writeTimeout:
          type: number
          title: Write timeout
          description: Amount of time (milliseconds) to wait for a write to complete
            before assuming connection is dead
        tokenTTLMinutes:
          type: number
          title: Auth Token TTL minutes
          minimum: 1
          maximum: 60
          description: The number of minutes before the internally generated
            authentication token expires, valid values between 1 and 60
        sendHeader:
          type: boolean
          title: Send auth token in initial record
          description: Upon connection, send a header-like record containing the auth
            token and other metadata.This record will not contain an actual
            event – only subsequent records will.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        description:
          type: string
          title: Description
        host:
          type: string
          title: Address
          description: The hostname of the receiver
        port:
          type: number
          title: Port
          maximum: 65535
          description: The port to connect to on the provided host
        excludeSelf:
          type: boolean
          title: Exclude current host IPs
          description: Exclude all IPs of the current host from the list of any resolved
            hostnames
        hosts:
          type: array
          title: Destinations
          description: Set of hosts to load-balance data to
          minItems: 1
          items:
            $ref: "#/components/schemas/HostConfOutputSyslog"
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (seconds)
          description: The interval in which to re-resolve any hostnames and pick up
            destinations from A records
        loadBalanceStatsPeriodSec:
          type: number
          minimum: 10
          title: Load balance stats period (seconds)
          description: How far back in time to keep traffic stats for load balancing
            purposes
        maxConcurrentSenders:
          type: number
          minimum: 0
          title: Connection limit
          description: Maximum number of concurrent connections (per Worker Process). A
            random set of IPs will be picked on every DNS resolution period. Use
            0 for unlimited.
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        authToken:
          type: string
          title: Auth token
          description: Optional authentication token to include as part of the connection
            header
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
      required:
        - type
    OutputWavefront:
      type: object
      required:
        - type
        - domain
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - wavefront
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        domain:
          type: string
          title: Domain name
          description: WaveFront domain name, e.g. "longboard"
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        token:
          type: string
          title: Auth token
          description: WaveFront API authentication token (see
            [here](https://docs.wavefront.com/wavefront_api.html#generating-an-api-token))
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputSignalfx:
      type: object
      required:
        - type
        - realm
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - signalfx
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        realm:
          type: string
          title: Realm
          description: SignalFx realm name, e.g. "us0". For a complete list of available
            SignalFx realm names, please check
            [here](https://docs.splunk.com/observability/en/get-started/service-description.html#sd-regions).
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        token:
          type: string
          title: Auth token
          description: SignalFx API access token (see
            [here](https://docs.signalfx.com/en/latest/admin-guide/tokens.html#working-with-access-tokens))
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputFilesystem:
      type: object
      required:
        - type
        - destPath
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - filesystem
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        destPath:
          type: string
          title: Output location
          description: Final destination for the output files
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 1800
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 1800
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        description:
          type: string
          title: Description
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputS3:
      type: object
      required:
        - type
        - bucket
        - stagePath
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - s3
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        endpoint:
          type: string
          title: Endpoint
          description: S3 service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to S3-compatible endpoint.
        enableAssumeRole:
          type: boolean
          title: Enable for S3
          description: Use Assume Role credentials to access S3
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: S3 bucket name
          description: "Name of the destination S3 bucket. Must be a JavaScript expression
            (which can evaluate to a constant value), enclosed in quotes or
            backticks. Can be evaluated only at initialization time. Example
            referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        region:
          type: string
          title: Region
          description: Region where the S3 bucket is located
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        awsSecretKey:
          type: string
          title: Secret key
          description: "Secret key. This value can be a constant or a JavaScript
            expression. Example: `${C.env.SOME_SECRET}`)"
        objectACL:
          $ref: "#/components/schemas/ObjectAclOptions"
        storageClass:
          $ref: "#/components/schemas/StorageClassOptions"
        serverSideEncryption:
          $ref: "#/components/schemas/ServerSideEncryptionForUploadedObjectsOptions"
        kmsKeyId:
          type: string
          title: KMS key ID
          description: ID or ARN of the KMS customer-managed key to use for encryption
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: This value can be a constant or a JavaScript expression
            (`${C.env.SOME_ACCESS_KEY}`)
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_objectACL:
          type: string
          description: Binds 'objectACL' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'objectACL' at runtime.
        __template_storageClass:
          type: string
          description: Binds 'storageClass' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'storageClass' at runtime.
        __template_serverSideEncryption:
          type: string
          description: Binds 'serverSideEncryption' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'serverSideEncryption' at runtime.
        __template_kmsKeyId:
          type: string
          description: Binds 'kmsKeyId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'kmsKeyId' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputAzureBlob:
      type: object
      required:
        - type
        - containerName
        - stagePath
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - azure_blob
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        containerName:
          type: string
          title: Container name
          description: The Azure Blob Storage container name. Name can include only
            lowercase letters, numbers, and hyphens. For dynamic container
            names, enter a JavaScript expression within quotes or backticks, to
            be evaluated at initialization. The expression can evaluate to a
            constant value and can reference Global Variables, such as
            `myContainer-${C.env["CRIBL_WORKER_ID"]}`.
        createContainer:
          type: boolean
          title: Create container
          description: Create the configured container in Azure Blob Storage if it does
            not already exist
        destPath:
          type: string
          title: Blob prefix
          description: Root directory prepended to path before uploading. Value can be a
            JavaScript expression enclosed in quotes or backticks, to be
            evaluated at initialization. The expression can evaluate to a
            constant value and can reference Global Variables, such as
            `myBlobPrefix-${C.env["CRIBL_WORKER_ID"]}`.
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files before compressing and
            moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts limit
          description: Maximum number of parts to upload in parallel per file
          minimum: 1
          maximum: 10
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 1800
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 1800
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptions"
        storageClass:
          type: string
          title: Blob access tier
          enum:
            - Inferred
            - Hot
            - Cool
            - Cold
            - Archive
          x-speakeasy-enum-descriptions:
            - Default account access tier
            - Hot tier
            - Cool tier
            - Cold tier
            - Archive tier
          x-speakeasy-unknown-values: allow
        description:
          type: string
          title: Description
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        connectionString:
          type: string
          title: Connection string
          description: Enter your Azure Storage account connection string. If left blank,
            Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING.
        textSecret:
          type: string
          title: Connection string (text secret)
          description: Select or create a stored text secret
        storageAccountName:
          type: string
          title: Storage account name
          description: The name of your Azure storage account
        tenantId:
          type: string
          title: Tenant ID
          description: The service principal's tenant ID
        clientId:
          type: string
          title: Client ID
          description: The service principal's client ID
        azureCloud:
          type: string
          title: Azure Cloud
          description: The Azure cloud to use. Defaults to Azure Public Cloud.
        endpointSuffix:
          type: string
          title: Endpoint suffix
          description: Endpoint suffix for the service URL. Takes precedence over the
            Azure Cloud setting. Defaults to core.windows.net.
        clientTextSecret:
          type: string
          title: Client secret (text secret)
          description: Select or create a stored text secret
        certificate:
          $ref: "#/components/schemas/CertificateTypeAzureBlobAuthTypeClientCert"
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_containerName:
          type: string
          description: Binds 'containerName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'containerName' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
        __template_connectionString:
          type: string
          description: Binds 'connectionString' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'connectionString' at runtime.
        __template_storageAccountName:
          type: string
          description: Binds 'storageAccountName' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'storageAccountName' at runtime.
        __template_tenantId:
          type: string
          description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tenantId' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
        __template_azureCloud:
          type: string
          description: Binds 'azureCloud' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'azureCloud' at runtime.
    OutputAzureDataExplorer:
      type: object
      required:
        - type
        - clusterUrl
        - database
        - table
        - compress
        - oauthEndpoint
        - tenantId
        - clientId
        - scope
        - oauthType
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - azure_data_explorer
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        clusterUrl:
          type: string
          title: Cluster base URI
          description: The base URI for your cluster. Typically,
            `https://<cluster>.<region>.kusto.windows.net`.
          pattern: ^https://
        database:
          type: string
          title: Database name
          description: Name of the database containing the table where data will be ingested
          pattern: ^[\w\s\-\.]+$
          maxLength: 260
        table:
          type: string
          title: Table name
          description: Name of the table to ingest data into
          pattern: ^[\w\-\.]+$
          maxLength: 1024
        validateDatabaseSettings:
          type: boolean
          title: Validate database settings
          description: When saving or starting the Destination, validate the database name
            and credentials; also validate table name, except when creating a
            new table. Disable if your Azure app does not have both the Database
            Viewer and the Table Viewer role.
        ingestMode:
          type: string
          title: Ingestion mode
          enum:
            - batching
            - streaming
          x-speakeasy-enum-descriptions:
            - Batching
            - Streaming
          x-speakeasy-unknown-values: allow
        oauthEndpoint:
          $ref: "#/components/schemas/MicrosoftEntraIdAuthenticationEndpointOptionsSasl"
        tenantId:
          type: string
          title: Tenant ID
          description: Directory ID (tenant identifier) in Azure Active Directory
        clientId:
          type: string
          title: Client ID
          description: client_id to pass in the OAuth request parameter
        scope:
          type: string
          title: Scope
          description: Scope to pass in the OAuth request parameter
        oauthType:
          title: Authentication method
          type: string
          enum:
            - clientSecret
            - clientTextSecret
            - certificate
          x-speakeasy-enum-descriptions:
            - Client secret
            - Client secret (text secret)
            - Certificate
          description: The type of OAuth 2.0 client credentials grant flow to use
          x-speakeasy-unknown-values: allow
        description:
          type: string
          title: Description
        clientSecret:
          type: string
          title: Client secret
          description: The client secret that you generated for your app in the Azure portal
        textSecret:
          type: string
          title: Client secret (text secret)
          description: Select or create a stored text secret
        certificate:
          type: object
          properties:
            certificateName:
              type: string
              title: Certificate
              description: The certificate you registered as credentials for your app in the
                Azure portal
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        isMappingObj:
          type: boolean
          title: Add mapping object
          description: Send a JSON mapping object instead of specifying an existing named
            data mapping
        mappingObj:
          type: string
          title: Data mapping
          description: Enter a JSON object that defines your desired data mapping
        mappingRef:
          type: string
          title: Data mapping
          description: Enter the name of a data mapping associated with your target table.
            Or, if incoming event and target table fields match exactly, you can
            leave the field empty.
          pattern: ^[\w\-\.]+$
        ingestUrl:
          type: string
          title: Ingestion service URI
          description: The ingestion service URI for your cluster. Typically,
            `https://ingest-<cluster>.<region>.kusto.windows.net`.
          pattern: ^https://
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files before compressing and
            moving to final destination. Use performant and stable storage.
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 1800
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 1800
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts limit
          description: Maximum number of parts to upload in parallel per file
          minimum: 1
          maximum: 10
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushImmediately:
          type: boolean
          title: Flush immediately
          description: Bypass the data management service's aggregation mechanism
        retainBlobOnSuccess:
          type: boolean
          title: Retain blob on success
          description: Prevent blob deletion after ingestion is complete
        extentTags:
          type: array
          title: Extent tags
          description: Strings or tags associated with the extent (ingested data shard)
          items:
            type: object
            required:
              - value
            properties:
              prefix:
                type: string
                title: Prefix (optional)
                enum:
                  - dropBy
                  - ingestBy
                x-speakeasy-enum-descriptions:
                  - drop-by
                  - ingest-by
                x-speakeasy-unknown-values: allow
              value:
                type: string
                title: Value
        ingestIfNotExists:
          type: array
          title: Enforce uniqueness via tag values
          description: Prevents duplicate ingestion by verifying whether an extent with
            the specified ingest-by tag already exists
          items:
            type: object
            required:
              - value
            properties:
              value:
                type: string
                title: Value
        reportLevel:
          type: string
          title: Report level
          description: Level of ingestion status reporting. Defaults to FailuresOnly.
          enum:
            - failuresOnly
            - doNotReport
            - failuresAndSuccesses
          x-speakeasy-enum-descriptions:
            - FailuresOnly
            - DoNotReport
            - FailuresAndSuccesses
          x-speakeasy-unknown-values: allow
        reportMethod:
          type: string
          title: Report method
          description: Target of the ingestion status reporting. Defaults to Queue.
          enum:
            - queue
            - table
            - queueAndTable
          x-speakeasy-enum-descriptions:
            - Queue
            - Table
            - QueueAndTable
          x-speakeasy-unknown-values: allow
        additionalProperties:
          type: array
          title: Additional fields
          description: Optionally, enter additional configuration properties to send to
            the ingestion service
          items:
            type: object
            required:
              - key
              - value
            properties:
              key:
                type: string
                title: Key
                pattern: ^[\w\-\.]+$
              value:
                type: string
                title: Value
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 4096
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        keepAlive:
          type: boolean
          title: Keep alive
          description: Disable to close the connection immediately after sending the
            outgoing request
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_clusterUrl:
          type: string
          description: Binds 'clusterUrl' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clusterUrl' at runtime.
        __template_database:
          type: string
          description: Binds 'database' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'database' at runtime.
        __template_table:
          type: string
          description: Binds 'table' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'table' at runtime.
        __template_oauthEndpoint:
          type: string
          description: Binds 'oauthEndpoint' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'oauthEndpoint' at runtime.
        __template_tenantId:
          type: string
          description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tenantId' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
        __template_scope:
          type: string
          description: Binds 'scope' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'scope' at runtime.
        __template_clientSecret:
          type: string
          description: Binds 'clientSecret' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientSecret' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
        __template_mappingRef:
          type: string
          description: Binds 'mappingRef' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'mappingRef' at runtime.
        __template_ingestUrl:
          type: string
          description: Binds 'ingestUrl' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'ingestUrl' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
    OutputAzureLogs:
      type: object
      required:
        - type
        - logType
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - azure_logs
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        logType:
          type: string
          title: Log Type
          description: The Log Type of events sent to this LogAnalytics workspace.
            Defaults to `Cribl`. Use only letters, numbers, and `_` characters,
            and can't exceed 100 characters. Can be overwritten by event field
            __logType.
          maxLength: 100
        resourceId:
          type: string
          title: Resource ID
          description: Optional Resource ID of the Azure resource to associate the data
            with. Can be overridden by the __resourceId event field. This ID
            populates the _ResourceId property, allowing the data to be included
            in resource-centric queries. If the ID is neither specified nor
            overridden, resource-centric queries will omit the data.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        apiUrl:
          type: string
          title: DNS name of API endpoint
          description: "The DNS name of the Log API endpoint that sends log data to a Log
            Analytics workspace in Azure Monitor. Defaults to
            .ods.opinsights.azure.com. @{product} will add a prefix and suffix
            to construct a URI in this format:
            <https://<Workspace_ID><your_DNS_name>/api/logs?api-version=<API
            version>."
          pattern: ^\.[^\/]+$
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          title: Authentication method
          type: string
          enum:
            - manual
            - secret
          description: Enter workspace ID and workspace key directly, or select a stored
            secret
          x-speakeasy-unknown-values: allow
        description:
          type: string
          title: Description
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        workspaceId:
          type: string
          title: Workspace ID
          description: Azure Log Analytics Workspace ID. See Azure Dashboard Workspace >
            Advanced settings.
        workspaceKey:
          type: string
          title: Workspace key
          description: Azure Log Analytics Workspace Primary or Secondary Shared Key. See
            Azure Dashboard Workspace > Advanced settings.
        keypairSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_workspaceId:
          type: string
          description: Binds 'workspaceId' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'workspaceId' at runtime.
        __template_workspaceKey:
          type: string
          description: Binds 'workspaceKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'workspaceKey' at runtime.
    OutputKinesis:
      type: object
      required:
        - type
        - streamName
        - region
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - kinesis
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        streamName:
          type: string
          title: Stream Name
          description: Kinesis stream name to send events to.
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: Region where the Kinesis stream is located
        endpoint:
          type: string
          title: Endpoint
          description: Kinesis stream service endpoint. If empty, defaults to the AWS
            Region-specific endpoint. Otherwise, it must point to Kinesis
            stream-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        enableAssumeRole:
          type: boolean
          title: Enable for Kinesis stream
          description: Use Assume Role credentials to access Kinesis stream
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        concurrency:
          type: number
          title: Put request concurrency
          description: Maximum number of ongoing put requests before blocking.
          minimum: 1
          maximum: 32
        maxRecordSizeKB:
          type: number
          title: Record size limit (KB, uncompressed)
          description: Maximum size (KB) of each individual record before compression. For
            uncompressed or non-compressible data 1MB is the max recommended
            size
          minimum: 1
          maximum: 10240
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Max record size.
        compression:
          type: string
          enum:
            - none
            - gzip
          title: Compression
          description: Compression type to use for records
          x-speakeasy-enum-descriptions:
            - None
            - Gzip
          x-speakeasy-unknown-values: allow
        useListShards:
          type: boolean
          title: ListShards API
          description: Provides higher stream rate limits, improving delivery speed and
            reliability by minimizing throttling. See the [ListShards
            API](https://docs.aws.amazon.com/kinesis/latest/APIReference/API_ListShards.html)
            documentation for details.
        asNdjson:
          type: boolean
          title: Send batched
          description: Batch events into a single record as NDJSON
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        maxEventsPerFlush:
          type: number
          title: Records-per-flush limit
          description: Maximum number of records to send in a single request
          minimum: 1
          maximum: 500
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_streamName:
          type: string
          description: Binds 'streamName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamName' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    OutputHoneycomb:
      type: object
      required:
        - type
        - dataset
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - honeycomb
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        dataset:
          type: string
          title: Dataset name
          description: Name of the dataset to send events to – e.g., observability
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsApi"
        description:
          type: string
          title: Description
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        team:
          type: string
          title: API key
          description: Team API key where the dataset belongs
        textSecret:
          type: string
          title: API key (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputAzureEventhub:
      type: object
      required:
        - type
        - brokers
        - topic
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - azure_eventhub
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        brokers:
          type: array
          title: Brokers
          description: List of Event Hubs Kafka brokers to connect to, eg.
            yourdomain.servicebus.windows.net:9093. The hostname can be found in
            the host portion of the primary or secondary connection string in
            Shared Access Policies.
          minItems: 1
          items:
            type: string
            minLength: 1
        topic:
          type: string
          title: Event Hub name
          description: The name of the Event Hub (Kafka Topic) to publish events. Can be
            overwritten using field __topicOut.
        ack:
          $ref: "#/components/schemas/AcknowledgmentsOptions"
        format:
          $ref: "#/components/schemas/RecordDataFormatOptions"
        maxRecordSizeKB:
          type: number
          minimum: 1
          title: Record size limit (KB, uncompressed)
          description: Maximum size of each record batch before compression. Setting
            should be < message.max.bytes settings in Event Hubs brokers.
        flushEventCount:
          type: number
          minimum: 1
          maximum: 10000
          title: Events-per-batch limit
          description: Maximum number of events in a batch before forcing a flush
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Max record size.
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a connection to complete successfully
          minimum: 1000
          maximum: 3600000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for Kafka to respond to a request
          minimum: 1000
          maximum: 3600000
        maxRetries:
          type: number
          title: Retry limit
          description: If messages are failing, you can set the maximum number of retries
            as high as 100 to prevent loss of data
          minimum: 0
          maximum: 100
        maxBackOff:
          type: number
          title: Backoff limit (ms)
          description: The maximum wait time for a retry, in milliseconds. Default (and
            minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180
            seconds).
          minimum: 30000
          maximum: 180000
        initialBackoff:
          type: number
          title: Initial retry interval (ms)
          description: Initial value used to calculate the retry, in milliseconds. Maximum
            is 600,000 ms (10 minutes).
          minimum: 300
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Set the backoff multiplier (2-20) to control the retry frequency
            for failed messages. For faster retries, use a lower multiplier. For
            slower retries with more delay between attempts, use a higher
            multiplier. The multiplier is used in an exponential backoff
            formula; see the Kafka
            [documentation](https://kafka.js.org/docs/retry-detailed) for
            details.
          minimum: 2
          maximum: 20
        authenticationTimeout:
          type: number
          title: Authentication timeout (ms)
          description: Maximum time to wait for Kafka to respond to an authentication
            request
          minimum: 1000
          maximum: 3600000
        reauthenticationThreshold:
          type: number
          title: Reauthentication threshold (ms)
          description: Specifies a time window during which @{product} can reauthenticate
            if needed. Creates the window measuring backward from the moment
            when credentials are set to expire.
          minimum: 1000
          maximum: 1800000
        sasl:
          $ref: "#/components/schemas/AuthenticationTypeUse"
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideType"
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_brokers:
          type: string
          description: Binds 'brokers' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'brokers' at runtime.
        __template_topic:
          type: string
          description: Binds 'topic' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topic' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputGoogleChronicle:
      type: object
      required:
        - type
        - logFormatType
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - google_chronicle
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        apiVersion:
          type: string
          title: API version
          enum:
            - v1
            - v2
          x-speakeasy-enum-descriptions:
            - V1
            - V2
          x-speakeasy-unknown-values: allow
        authenticationMethod:
          type: string
          title: Authentication method
          enum:
            - manual
            - secret
            - serviceAccount
            - serviceAccountSecret
          x-speakeasy-enum-descriptions:
            - API key
            - API key secret
            - Service account credentials
            - Service account credentials secret
          x-speakeasy-unknown-values: allow
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        logFormatType:
          type: string
          title: Send events as
          description: ""
          enum:
            - unstructured
            - udm
          x-speakeasy-enum-descriptions:
            - Unstructured
            - UDM
          x-speakeasy-unknown-values: allow
        region:
          type: string
          title: Region
          description: Regional endpoint to send events to
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1
          maximum: 1024
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        description:
          type: string
          title: Description
        extraLogTypes:
          type: array
          title: Custom log types
          description: Custom log types. If the value "Custom" is selected in the setting
            "Default log type" above, the first custom log type in this table
            will be automatically selected as default log type.
          items:
            type: object
            required:
              - logType
            properties:
              logType:
                type: string
                title: Log Type
                pattern: ^[A-Z0-9_]+$
              description:
                type: string
                title: Description
        logType:
          type: string
          title: Default log type
          description: Default log type value to send to SecOps. Can be overwritten by
            event field __logType.
        logTextField:
          type: string
          title: Log text field
          description: Name of the event field that contains the log text to send. If not
            specified, Stream sends a JSON representation of the whole event.
        customerId:
          type: string
          title: Customer ID
          description: A unique identifier (UUID) for your Google SecOps instance. This is
            provided by your Google representative and is required for API V2
            authentication.
        namespace:
          type: string
          title: Namespace
          description: User-configured environment namespace to identify the data domain
            the logs originated from. Use namespace as a tag to identify the
            appropriate data domain for indexing and enrichment functionality.
            Can be overwritten by event field __namespace.
        customLabels:
          type: array
          title: Custom labels
          description: "Custom labels to be added to every batch "
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        udmType:
          type: string
          title: UDM type
          description: Defines the specific format for UDM events sent to Google SecOps.
            This must match the type of UDM data being sent.
          enum:
            - entities
            - logs
          x-speakeasy-unknown-values: allow
        apiKey:
          type: string
          title: API key
          description: Organization's API key in Google SecOps
        apiKeySecret:
          type: string
          title: API key (text secret)
          description: Select or create a stored text secret
        serviceAccountCredentials:
          type: string
          title: Service account credentials
          description: Contents of service account credentials (JSON keys) file downloaded
            from Google Cloud. To upload a file, click the upload button at this
            field's upper right.
        serviceAccountCredentialsSecret:
          type: string
          title: Service account credentials (text secret)
          description: Select or create a stored text secret
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_apiVersion:
          type: string
          description: Binds 'apiVersion' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'apiVersion' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_customerId:
          type: string
          description: Binds 'customerId' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'customerId' at runtime.
    OutputGoogleCloudStorage:
      type: object
      required:
        - type
        - bucket
        - endpoint
        - region
        - stagePath
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - google_cloud_storage
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        bucket:
          type: string
          title: Bucket name
          description: "Name of the destination bucket. This value can be a constant or a
            JavaScript expression that can only be evaluated at init time.
            Example of referencing a Global Variable:
            `myBucket-${C.vars.myVar}`."
        region:
          type: string
          title: Region
          description: Region where the bucket is located
        endpoint:
          type: string
          title: Endpoint
          description: Google Cloud Storage service endpoint
        awsAuthenticationMethod:
          type: string
          title: Authentication method
          enum:
            - auto
            - manual
            - secret
          x-speakeasy-enum-descriptions:
            - auto
            - manual
            - Secret Key pair
          x-speakeasy-unknown-values: allow
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        objectACL:
          $ref: "#/components/schemas/ObjectAclOptionsAuthenticatedreadBucketownerfullcon\
            trol"
        storageClass:
          $ref: "#/components/schemas/StorageClassOptionsArchiveColdline"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 1800
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 1800
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        description:
          type: string
          title: Description
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        awsApiKey:
          type: string
          title: Access key
          description: HMAC access key. This value can be a constant or a JavaScript
            expression, such as `${C.env.GCS_ACCESS_KEY}`.
        awsSecretKey:
          type: string
          title: Secret
          description: HMAC secret. This value can be a constant or a JavaScript
            expression, such as `${C.env.GCS_SECRET}`.
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_objectACL:
          type: string
          description: Binds 'objectACL' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'objectACL' at runtime.
        __template_storageClass:
          type: string
          description: Binds 'storageClass' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'storageClass' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
    OutputGoogleCloudLogging:
      type: object
      required:
        - type
        - logLocationType
        - logLocationExpression
        - logNameExpression
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - google_cloud_logging
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        logLocationType:
          type: string
          title: Log location type
          x-speakeasy-enum-descriptions:
            - Project
            - Organization
            - Billing Account
            - Folder
          enum:
            - project
            - organization
            - billingAccount
            - folder
          x-speakeasy-unknown-values: allow
        logNameExpression:
          type: string
          title: Log name expression
          description: JavaScript expression to compute the value of the log name. If
            Validate and correct log name is enabled, invalid characters
            (characters other than alphanumerics, forward-slashes, underscores,
            hyphens, and periods) will be replaced with an underscore.
        sanitizeLogNames:
          type: boolean
          title: Validate and correct log name
        payloadFormat:
          type: string
          title: Payload format
          description: Format to use when sending payload. Defaults to Text.
          enum:
            - text
            - json
          x-speakeasy-enum-descriptions:
            - Text
            - JSON
          x-speakeasy-unknown-values: allow
        logLabels:
          type: array
          title: Log labels
          description: Labels to apply to the log entry
          items:
            $ref: "#/components/schemas/LogLabelConfOutputGoogleCloudLogging"
        resourceTypeExpression:
          type: string
          title: Resource type expression
          description: JavaScript expression to compute the value of the managed resource
            type field. Must evaluate to one of the valid values
            [here](https://cloud.google.com/logging/docs/api/v2/resource-list#resource-types).
            Defaults to "global".
        resourceTypeLabels:
          type: array
          title: Resource labels
          description: Labels to apply to the managed resource. These must correspond to
            the valid labels for the specified resource type (see
            [here](https://cloud.google.com/logging/docs/api/v2/resource-list#resource-types)).
            Otherwise, they will be dropped by Google Cloud Logging.
          items:
            $ref: "#/components/schemas/LogLabelConfOutputGoogleCloudLogging"
        severityExpression:
          type: string
          title: Severity expression
          description: JavaScript expression to compute the value of the severity field.
            Must evaluate to one of the severity values supported by Google
            Cloud Logging
            [here](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logseverity)
            (case insensitive). Defaults to "DEFAULT".
        insertIdExpression:
          type: string
          title: Insert ID expression
          description: JavaScript expression to compute the value of the insert ID field.
        googleAuthMethod:
          $ref: "#/components/schemas/GoogleAuthenticationMethodOptions"
        serviceAccountCredentials:
          type: string
          title: Service account credentials
          description: Contents of service account credentials (JSON keys) file downloaded
            from Google Cloud. To upload a file, click the upload button at this
            field's upper right.
        secret:
          type: string
          title: Service account credentials (text secret)
          description: Select or create a stored text secret
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body.
          minimum: 1024
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Max number of events to include in the request body. Default is 0
            (unlimited).
          minimum: 0
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Max record size.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking.
          minimum: 1
          maximum: 32
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it.
        throttleRateReqPerSec:
          type: integer
          title: Throttle request rate
          description: Maximum number of requests to limit to per second.
          maximum: 2000
        requestMethodExpression:
          type: string
          title: Request method expression
          description: A JavaScript expression that evaluates to the HTTP request method
            as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        requestUrlExpression:
          type: string
          title: Request URL expression
          description: A JavaScript expression that evaluates to the HTTP request URL as a
            string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        requestSizeExpression:
          type: string
          title: Request size expression
          description: A JavaScript expression that evaluates to the HTTP request size as
            a string, in int64 format. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        statusExpression:
          type: string
          title: Request status expression
          description: A JavaScript expression that evaluates to the HTTP request method
            as a number. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        responseSizeExpression:
          type: string
          title: Response size expression
          description: A JavaScript expression that evaluates to the HTTP response size as
            a string, in int64 format. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        userAgentExpression:
          type: string
          title: Request user agent expression
          description: A JavaScript expression that evaluates to the HTTP request user
            agent as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        remoteIpExpression:
          type: string
          title: Remote IP expression
          description: A JavaScript expression that evaluates to the HTTP request remote
            IP as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        serverIpExpression:
          type: string
          title: Server IP expression
          description: A JavaScript expression that evaluates to the HTTP request server
            IP as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        refererExpression:
          type: string
          title: Referer expression
          description: A JavaScript expression that evaluates to the HTTP request referer
            as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        latencyExpression:
          type: string
          title: Latency expression
          description: A JavaScript expression that evaluates to the HTTP request latency,
            formatted as <seconds>.<nanoseconds>s (for example, 1.23s). See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        cacheLookupExpression:
          type: string
          title: Cache lookup expression
          description: A JavaScript expression that evaluates to the HTTP request cache
            lookup as a boolean. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        cacheHitExpression:
          type: string
          title: Cache hit expression
          description: A JavaScript expression that evaluates to the HTTP request cache
            hit as a boolean. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        cacheValidatedExpression:
          type: string
          title: Cache validated with origin server expression
          description: A JavaScript expression that evaluates to the HTTP request cache
            validated with origin server as a boolean. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        cacheFillBytesExpression:
          type: string
          title: Cache fill bytes expression
          description: A JavaScript expression that evaluates to the HTTP request cache
            fill bytes as a string, in int64 format. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        protocolExpression:
          type: string
          title: Protocol expression
          description: A JavaScript expression that evaluates to the HTTP request protocol
            as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#httprequest)
            for details.
        idExpression:
          type: string
          title: ID expression
          description: A JavaScript expression that evaluates to the log entry operation
            ID as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentryoperation)
            for details.
        producerExpression:
          type: string
          title: Producer expression
          description: A JavaScript expression that evaluates to the log entry operation
            producer as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentryoperation)
            for details.
        firstExpression:
          type: string
          title: First expression
          description: A JavaScript expression that evaluates to the log entry operation
            first flag as a boolean. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentryoperation)
            for details.
        lastExpression:
          type: string
          title: Last expression
          description: A JavaScript expression that evaluates to the log entry operation
            last flag as a boolean. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentryoperation)
            for details.
        fileExpression:
          type: string
          title: File expression
          description: A JavaScript expression that evaluates to the log entry source
            location file as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentrysourcelocation)
            for details.
        lineExpression:
          type: string
          title: Line expression
          description: A JavaScript expression that evaluates to the log entry source
            location line as a string, in int64 format. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentrysourcelocation)
            for details.
        functionExpression:
          type: string
          title: Function expression
          description: A JavaScript expression that evaluates to the log entry source
            location function as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logentrysourcelocation)
            for details.
        uidExpression:
          type: string
          title: UID expression
          description: A JavaScript expression that evaluates to the log entry log split
            UID as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logsplit)
            for details.
        indexExpression:
          type: string
          title: Index expression
          description: A JavaScript expression that evaluates to the log entry log split
            index as a number. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logsplit)
            for details.
        totalSplitsExpression:
          type: string
          title: Total splits expression
          description: A JavaScript expression that evaluates to the log entry log split
            total splits as a number. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry#logsplit)
            for details.
        traceExpression:
          type: string
          title: Trace expression
          description: A JavaScript expression that evaluates to the REST resource name of
            the trace being written as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry)
            for details.
        spanIdExpression:
          type: string
          title: Span ID expression
          description: A JavaScript expression that evaluates to the ID of the cloud trace
            span associated with the current operation in which the log is being
            written as a string. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry)
            for details.
        traceSampledExpression:
          type: string
          title: Trace sampled expression
          description: A JavaScript expression that evaluates to the the sampling decision
            of the span associated with the log entry. See the
            [documentation](https://cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry)
            for details.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        description:
          type: string
          title: Description
        logLocationExpression:
          title: Folder ID expression
          description: JavaScript expression to compute the value of the folder ID with
            which log entries should be associated. If Validate and correct log
            name is enabled, invalid characters (characters other than
            alphanumerics, forward-slashes, underscores, hyphens, and periods)
            will be replaced with an underscore.
          type: string
        payloadExpression:
          title: Payload object expression
          description: JavaScript expression to compute the value of the payload. Must
            evaluate to a JavaScript object value. If an invalid value is
            encountered it will result in the default value instead. Defaults to
            the entire event.
          type: string
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_logLocationType:
          type: string
          description: Binds 'logLocationType' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'logLocationType' at
            runtime.
        __template_logNameExpression:
          type: string
          description: Binds 'logNameExpression' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'logNameExpression' at runtime.
        __template_payloadFormat:
          type: string
          description: Binds 'payloadFormat' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'payloadFormat' at runtime.
        __template_resourceTypeExpression:
          type: string
          description: Binds 'resourceTypeExpression' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'resourceTypeExpression' at runtime.
        __template_severityExpression:
          type: string
          description: Binds 'severityExpression' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'severityExpression' at runtime.
        __template_insertIdExpression:
          type: string
          description: Binds 'insertIdExpression' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'insertIdExpression' at runtime.
        __template_traceExpression:
          type: string
          description: Binds 'traceExpression' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'traceExpression' at
            runtime.
        __template_spanIdExpression:
          type: string
          description: Binds 'spanIdExpression' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'spanIdExpression' at runtime.
        __template_traceSampledExpression:
          type: string
          description: Binds 'traceSampledExpression' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'traceSampledExpression' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_logLocationExpression:
          type: string
          description: Binds 'logLocationExpression' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'logLocationExpression' at runtime.
        __template_payloadExpression:
          type: string
          description: Binds 'payloadExpression' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'payloadExpression' at runtime.
    OutputGoogleCloudObservability:
      type: object
      required:
        - type
        - googleAuthMethod
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - google_cloud_observability
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        protocol:
          type: string
          enum:
            - grpc
          x-speakeasy-unknown-values: allow
        otlpVersion:
          type: string
          enum:
            - 1.3.1
          x-speakeasy-unknown-values: allow
        endpoint:
          type: string
          title: Endpoint
          description: Fixed Google Cloud Observability gRPC endpoint. All three signals
            share this transport; the OTLP service path determines whether the
            call lands on traces, metrics, or logs.
          enum:
            - telemetry.googleapis.com:443
          x-speakeasy-unknown-values: allow
        googleAuthMethod:
          type: string
          title: Google authentication method
          description: Choose Auto to use Google Application Default Credentials (ADC).
            Choose Secret to select or create a stored secret that references
            Google service account credentials.
          enum:
            - auto
            - secret
          x-speakeasy-enum-descriptions:
            - Auto
            - Secret
          x-speakeasy-unknown-values: allow
        metadata:
          type: array
          title: Metadata
          description: List of key-value pairs to send with each gRPC request. Value
            supports JavaScript expressions that are evaluated just once, when
            the destination gets started. To pass credentials as metadata, use
            'C.Secret'.
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        dynamicHeadersEnabled:
          type: boolean
          title: Use dynamic metadata
          description: Batch event data upon dynamic metadata (whether presented or not)
        dynamicHeadersField:
          type: string
          title: Dynamic metadata field
          description: When presented, this field which contains metadata, will be
            injected into the Destination metadata and used to batch events.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body sent to Google Cloud
            Observability
          minimum: 1024
          maximum: 10240
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often the sender should ping the peer to keep the connection open
          minimum: 1
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeExtended"
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Max number of events to include in the request body. Default is 0
            (unlimited). Use to keep outgoing data points within GCO request
            limits. For metrics, combine with the OTLP Metrics function
            batchSize.
          minimum: 0
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        secret:
          type: string
          title: Service account credentials (text secret)
          description: Select or create a stored text secret
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputGooglePubsub:
      type: object
      required:
        - type
        - topicName
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - google_pubsub
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        topicName:
          type: string
          title: Topic ID
          description: ID of the topic to send events to.
        createTopic:
          type: boolean
          title: Create topic
          description: If enabled, create topic if it does not exist.
        orderedDelivery:
          type: boolean
          title: Ordered delivery
          description: If enabled, send events in the order they were added to the queue.
            For this to work correctly, the process receiving events must have
            ordering enabled.
        region:
          type: string
          title: Region
          description: Region to publish messages to. Select 'default' to allow Google to
            auto-select the nearest region. When using ordered delivery, the
            selected region must be allowed by message storage policy.
        googleAuthMethod:
          $ref: "#/components/schemas/GoogleAuthenticationMethodOptions"
        serviceAccountCredentials:
          type: string
          title: Service account credentials
          description: Contents of service account credentials (JSON keys) file downloaded
            from Google Cloud. To upload a file, click the upload button at this
            field's upper right.
        secret:
          type: string
          title: Service account credentials (text secret)
          description: Select or create a stored text secret
        batchSize:
          type: number
          title: Batch size
          minimum: 1
          maximum: 10000
          description: The maximum number of items the Google API should batch before it
            sends them to the topic.
        batchTimeout:
          type: number
          title: Batch timeout (ms)
          minimum: 1
          maximum: 100000
          description: The maximum amount of time, in milliseconds, that the Google API
            should wait to send a batch (if the Batch size is not reached).
        maxQueueSize:
          type: number
          title: Queue size limit
          description: Maximum number of queued batches before blocking.
          minimum: 1
        maxRecordSizeKB:
          type: number
          title: Batch size limit (KB)
          description: Maximum size (KB) of batches to send.
          minimum: 1
          maximum: 256
        flushPeriod:
          title: Flush period (sec)
          description: Maximum time to wait before sending a batch (when batch size limit
            is not reached)
          type: number
        maxInProgress:
          type: number
          title: Concurrent request limit
          description: The maximum number of in-progress API requests before backpressure
            is applied.
          minimum: 1
          maximum: 100
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_topicName:
          type: string
          description: Binds 'topicName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topicName' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputExabeam:
      type: object
      required:
        - type
        - bucket
        - region
        - endpoint
        - stagePath
        - collectorInstanceId
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - exabeam
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        bucket:
          type: string
          title: Bucket name
          description: "Name of the destination bucket. A constant or a JavaScript
            expression that can only be evaluated at init time. Example of
            referencing a JavaScript Global Variable:
            `myBucket-${C.vars.myVar}`."
        region:
          type: string
          title: Region
          description: Region where the bucket is located
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        endpoint:
          type: string
          title: Endpoint
          description: Google Cloud Storage service endpoint
        objectACL:
          $ref: "#/components/schemas/ObjectAclOptionsAuthenticatedreadBucketownerfullcon\
            trol"
        storageClass:
          $ref: "#/components/schemas/StorageClassOptionsArchiveColdline"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 1800
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 1800
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        encodedConfiguration:
          type: string
          title: Exabeam connection string
          description: Enter an encoded string containing Exabeam configurations
        collectorInstanceId:
          type: string
          title: Collector instance ID
          description: >
            ID of the Exabeam Collector where data should be sent. Example:
            11112222-3333-4444-5555-666677778888
        siteName:
          type: string
          title: Site name
          description: Constant or JavaScript expression to create an Exabeam site name.
            Values that aren't successfully evaluated will be treated as string
            constants.
        siteId:
          type: string
          title: Site ID
          description: Exabeam site ID. If left blank, @{product} will use the value of
            the Exabeam site name.
        timezoneOffset:
          type: string
          title: Timezone offset
        awsApiKey:
          type: string
          title: Access key
          description: HMAC access key. Can be a constant or a JavaScript expression, such
            as `${C.env.GCS_ACCESS_KEY}`.
        awsSecretKey:
          type: string
          title: Secret
          description: HMAC secret. Can be a constant or a JavaScript expression, such as
            `${C.env.GCS_SECRET}`.
        description:
          type: string
          title: Description
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_objectACL:
          type: string
          description: Binds 'objectACL' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'objectACL' at runtime.
        __template_storageClass:
          type: string
          description: Binds 'storageClass' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'storageClass' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputKafka:
      type: object
      required:
        - type
        - brokers
        - topic
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - kafka
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        brokers:
          type: array
          title: Bootstrap servers
          description: Enter each Kafka bootstrap server you want to use. Specify hostname
            and port, e.g., mykafkabroker:9092, or just hostname, in which case
            @{product} will assign port 9092.
          minItems: 1
          items:
            type: string
            minLength: 1
        topic:
          type: string
          title: Topic
          description: The topic to publish events to. Can be overridden using the
            __topicOut field.
        ack:
          $ref: "#/components/schemas/AcknowledgmentsOptionsAllLeader"
        format:
          $ref: "#/components/schemas/RecordDataFormatOptionsJsonProtobuf"
        compression:
          $ref: "#/components/schemas/CompressionOptionsGzipLz4"
        maxRecordSizeKB:
          type: number
          minimum: 1
          title: Record size limit (KB, uncompressed)
          description: Maximum size of each record batch before compression. The value
            must not exceed the Kafka brokers' message.max.bytes setting.
        flushEventCount:
          type: number
          minimum: 1
          maximum: 10000
          title: Events-per-batch limit
          description: The maximum number of events you want the Destination to allow in a
            batch before forcing a flush
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: The maximum amount of time you want the Destination to wait before
            forcing a flush. Shorter intervals tend to result in smaller batches
            being sent.
        kafkaSchemaRegistry:
          $ref: "#/components/schemas/KafkaSchemaRegistryAuthenticationTypeTemplateschema\
            RegistryUrlAuth"
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a connection to complete successfully
          minimum: 1000
          maximum: 3600000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for Kafka to respond to a request
          minimum: 1000
          maximum: 3600000
        maxRetries:
          type: number
          title: Retry limit
          description: If messages are failing, you can set the maximum number of retries
            as high as 100 to prevent loss of data
          minimum: 0
          maximum: 100
        maxBackOff:
          type: number
          title: Backoff limit (ms)
          description: The maximum wait time for a retry, in milliseconds. Default (and
            minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180
            seconds).
          minimum: 30000
          maximum: 180000
        initialBackoff:
          type: number
          title: Initial retry interval (ms)
          description: Initial value used to calculate the retry, in milliseconds. Maximum
            is 600,000 ms (10 minutes).
          minimum: 300
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Set the backoff multiplier (2-20) to control the retry frequency
            for failed messages. For faster retries, use a lower multiplier. For
            slower retries with more delay between attempts, use a higher
            multiplier. The multiplier is used in an exponential backoff
            formula; see the Kafka
            [documentation](https://kafka.js.org/docs/retry-detailed) for
            details.
          minimum: 2
          maximum: 20
        authenticationTimeout:
          type: number
          title: Authentication timeout (ms)
          description: Maximum time to wait for Kafka to respond to an authentication
            request
          minimum: 1000
          maximum: 3600000
        reauthenticationThreshold:
          type: number
          title: Reauthentication threshold (ms)
          description: Specifies a time window during which @{product} can reauthenticate
            if needed. Creates the window measuring backward from the moment
            when credentials are set to expire.
          minimum: 1000
          maximum: 1800000
        sasl:
          $ref: "#/components/schemas/AuthenticationType"
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        protobufLibraryId:
          type: string
          title: Definition set
          description: Select a set of Protobuf definitions for the events you want to send
        protobufEncodingId:
          type: string
          title: Object type
          description: Select the type of object you want the Protobuf definitions to use
            for event encoding
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_topic:
          type: string
          description: Binds 'topic' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topic' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_compression:
          type: string
          description: Binds 'compression' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compression' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputConfluentCloud:
      type: object
      required:
        - type
        - brokers
        - topic
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - confluent_cloud
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        brokers:
          type: array
          title: Bootstrap servers
          description: List of Confluent Cloud bootstrap servers to use, such as
            yourAccount.confluent.cloud:9092.
          minItems: 1
          items:
            type: string
            minLength: 1
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        topic:
          type: string
          title: Topic
          description: The topic to publish events to. Can be overridden using the
            __topicOut field.
        ack:
          $ref: "#/components/schemas/AcknowledgmentsOptionsAllLeader"
        format:
          $ref: "#/components/schemas/RecordDataFormatOptionsJsonProtobuf"
        compression:
          $ref: "#/components/schemas/CompressionOptionsGzipLz4"
        maxRecordSizeKB:
          type: number
          minimum: 1
          title: Record size limit (KB, uncompressed)
          description: Maximum size of each record batch before compression. The value
            must not exceed the Kafka brokers' message.max.bytes setting.
        flushEventCount:
          type: number
          minimum: 1
          maximum: 10000
          title: Events-per-batch limit
          description: The maximum number of events you want the Destination to allow in a
            batch before forcing a flush
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: The maximum amount of time you want the Destination to wait before
            forcing a flush. Shorter intervals tend to result in smaller batches
            being sent.
        kafkaSchemaRegistry:
          $ref: "#/components/schemas/KafkaSchemaRegistryAuthenticationTypeTemplateschema\
            RegistryUrlAuth"
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a connection to complete successfully
          minimum: 1000
          maximum: 3600000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for Kafka to respond to a request
          minimum: 1000
          maximum: 3600000
        maxRetries:
          type: number
          title: Retry limit
          description: If messages are failing, you can set the maximum number of retries
            as high as 100 to prevent loss of data
          minimum: 0
          maximum: 100
        maxBackOff:
          type: number
          title: Backoff limit (ms)
          description: The maximum wait time for a retry, in milliseconds. Default (and
            minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180
            seconds).
          minimum: 30000
          maximum: 180000
        initialBackoff:
          type: number
          title: Initial retry interval (ms)
          description: Initial value used to calculate the retry, in milliseconds. Maximum
            is 600,000 ms (10 minutes).
          minimum: 300
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Set the backoff multiplier (2-20) to control the retry frequency
            for failed messages. For faster retries, use a lower multiplier. For
            slower retries with more delay between attempts, use a higher
            multiplier. The multiplier is used in an exponential backoff
            formula; see the Kafka
            [documentation](https://kafka.js.org/docs/retry-detailed) for
            details.
          minimum: 2
          maximum: 20
        authenticationTimeout:
          type: number
          title: Authentication timeout (ms)
          description: Maximum time to wait for Kafka to respond to an authentication
            request
          minimum: 1000
          maximum: 3600000
        reauthenticationThreshold:
          type: number
          title: Reauthentication threshold (ms)
          description: Specifies a time window during which @{product} can reauthenticate
            if needed. Creates the window measuring backward from the moment
            when credentials are set to expire.
          minimum: 1000
          maximum: 1800000
        sasl:
          $ref: "#/components/schemas/AuthenticationType"
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        protobufLibraryId:
          type: string
          title: Definition set
          description: Select a set of Protobuf definitions for the events you want to send
        protobufEncodingId:
          type: string
          title: Object type
          description: Select the type of object you want the Protobuf definitions to use
            for event encoding
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_brokers:
          type: string
          description: Binds 'brokers' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'brokers' at runtime.
        __template_topic:
          type: string
          description: Binds 'topic' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topic' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_compression:
          type: string
          description: Binds 'compression' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compression' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputMsk:
      type: object
      required:
        - type
        - brokers
        - topic
        - region
        - awsAuthenticationMethod
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - msk
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        brokers:
          type: array
          title: Bootstrap servers
          description: Enter each Kafka bootstrap server you want to use. Specify hostname
            and port, e.g., mykafkabroker:9092, or just hostname, in which case
            @{product} will assign port 9092.
          minItems: 1
          items:
            type: string
            minLength: 1
        topic:
          type: string
          title: Topic
          description: The topic to publish events to. Can be overridden using the
            __topicOut field.
        ack:
          $ref: "#/components/schemas/AcknowledgmentsOptionsAllLeader"
        format:
          $ref: "#/components/schemas/RecordDataFormatOptionsJsonProtobuf"
        compression:
          $ref: "#/components/schemas/CompressionOptionsGzipLz4"
        maxRecordSizeKB:
          type: number
          minimum: 1
          title: Record size limit (KB, uncompressed)
          description: Maximum size of each record batch before compression. The value
            must not exceed the Kafka brokers' message.max.bytes setting.
        flushEventCount:
          type: number
          minimum: 1
          maximum: 10000
          title: Events-per-batch limit
          description: The maximum number of events you want the Destination to allow in a
            batch before forcing a flush
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: The maximum amount of time you want the Destination to wait before
            forcing a flush. Shorter intervals tend to result in smaller batches
            being sent.
        kafkaSchemaRegistry:
          $ref: "#/components/schemas/KafkaSchemaRegistryAuthenticationTypeTemplateschema\
            RegistryUrlAuth"
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a connection to complete successfully
          minimum: 1000
          maximum: 3600000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for Kafka to respond to a request
          minimum: 1000
          maximum: 3600000
        maxRetries:
          type: number
          title: Retry limit
          description: If messages are failing, you can set the maximum number of retries
            as high as 100 to prevent loss of data
          minimum: 0
          maximum: 100
        maxBackOff:
          type: number
          title: Backoff limit (ms)
          description: The maximum wait time for a retry, in milliseconds. Default (and
            minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180
            seconds).
          minimum: 30000
          maximum: 180000
        initialBackoff:
          type: number
          title: Initial retry interval (ms)
          description: Initial value used to calculate the retry, in milliseconds. Maximum
            is 600,000 ms (10 minutes).
          minimum: 300
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Set the backoff multiplier (2-20) to control the retry frequency
            for failed messages. For faster retries, use a lower multiplier. For
            slower retries with more delay between attempts, use a higher
            multiplier. The multiplier is used in an exponential backoff
            formula; see the Kafka
            [documentation](https://kafka.js.org/docs/retry-detailed) for
            details.
          minimum: 2
          maximum: 20
        authenticationTimeout:
          type: number
          title: Authentication timeout (ms)
          description: Maximum time to wait for Kafka to respond to an authentication
            request
          minimum: 1000
          maximum: 3600000
        reauthenticationThreshold:
          type: number
          title: Reauthentication threshold (ms)
          description: Specifies a time window during which @{product} can reauthenticate
            if needed. Creates the window measuring backward from the moment
            when credentials are set to expire.
          minimum: 1000
          maximum: 1800000
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: Region where the MSK cluster is located
        endpoint:
          type: string
          title: Endpoint
          description: MSK cluster service endpoint. If empty, defaults to the AWS
            Region-specific endpoint. Otherwise, it must point to MSK
            cluster-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        enableAssumeRole:
          type: boolean
          title: Enable for MSK
          description: Use Assume Role credentials to access MSK
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        protobufLibraryId:
          type: string
          title: Definition set
          description: Select a set of Protobuf definitions for the events you want to send
        protobufEncodingId:
          type: string
          title: Object type
          description: Select the type of object you want the Protobuf definitions to use
            for event encoding
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_topic:
          type: string
          description: Binds 'topic' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topic' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_compression:
          type: string
          description: Binds 'compression' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compression' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    OutputElastic:
      type: object
      required:
        - type
        - index
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - elastic
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        loadBalanced:
          type: boolean
          title: Load balancing
          description: Enable for optimal performance. Even if you have one hostname, it
            can expand to multiple IPs. If disabled, consider enabling
            round-robin DNS.
        index:
          type: string
          title: Index or data stream
          description: Index or data stream to send events to. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be overwritten by an event's __index field.
        docType:
          type: string
          title: Type
          description: Document type to use for events. Can be overwritten by an event's
            __type field.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 102400
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        extraParams:
          type: array
          title: Extra parameters
          items:
            $ref: "#/components/schemas/SaslExtensionConfInputKafka"
        auth:
          $ref: "#/components/schemas/AuthTypeTemplatemanualApiKeyAuthType"
        elasticVersion:
          type: string
          title: Elastic version
          description: Optional Elasticsearch version, used to format events. If not
            specified, will auto-discover version.
          enum:
            - auto
            - "6"
            - "7"
          x-speakeasy-enum-descriptions:
            - Auto
            - 6.x
            - 7.x
          x-speakeasy-unknown-values: allow
        elasticPipeline:
          type: string
          title: Elastic pipeline
          description: Optional Elasticsearch destination pipeline
        includeDocId:
          type: boolean
          title: Include document _id
          description: Include the `document_id` field when sending events to an Elastic
            TSDS (time series data stream)
        writeAction:
          type: string
          title: Write action
          description: Action to use when writing events. Must be set to `Create` when
            writing to a data stream.
          enum:
            - index
            - create
          x-speakeasy-enum-descriptions:
            - Index
            - Create
          x-speakeasy-unknown-values: allow
        retryPartialErrors:
          type: boolean
          title: Retry partial errors
          description: Retry failed events when a bulk request to Elastic is successful,
            but the response body returns an error for one or more events in the
            batch
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        url:
          type: string
          title: Bulk API URL or Cloud ID
          description: "The Cloud ID or URL to an Elastic cluster to send events to.
            Example: http://elastic:9200/_bulk"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        excludeSelf:
          type: boolean
          title: Exclude current host IPs
          description: Exclude all IPs of the current host from the list of any resolved
            hostnames
        urls:
          type: array
          title: Bulk API URLs
          description: ""
          minItems: 1
          items:
            type: object
            required:
              - url
            properties:
              url:
                type: string
                title: URL
                description: "The URL to an Elastic node to send events to. Example:
                  http://elastic:9200/_bulk"
              weight:
                type: number
                title: Load Weight
                description: Assign a weight (>0) to each endpoint to indicate its
                  traffic-handling capability
                minimum: 0
              __template_url:
                type: string
                description: Binds 'url' to a variable for dynamic value resolution. Set to
                  variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                  (group-scoped). Variable value overrides 'url' at runtime.
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (seconds)
          description: The interval in which to re-resolve any hostnames and pick up
            destinations from A records
        loadBalanceStatsPeriodSec:
          type: number
          minimum: 10
          title: Load balance stats period (seconds)
          description: How far back in time to keep traffic stats for load balancing
            purposes
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_index:
          type: string
          description: Binds 'index' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'index' at runtime.
        __template_docType:
          type: string
          description: Binds 'docType' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'docType' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_elasticPipeline:
          type: string
          description: Binds 'elasticPipeline' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'elasticPipeline' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
    OutputElasticCloud:
      type: object
      required:
        - type
        - url
        - index
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - elastic_cloud
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        url:
          type: string
          title: Cloud ID
          description: Enter Cloud ID of the Elastic Cloud environment to send events to
        index:
          type: string
          title: Data stream or index
          description: Data stream or index to send events to. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be overwritten by an event's __index field.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 102400
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        extraParams:
          type: array
          title: Extra parameters
          description: Extra parameters to use in HTTP requests
          items:
            $ref: "#/components/schemas/SaslExtensionConfInputKafka"
        auth:
          $ref: "#/components/schemas/AuthTypeTemplatemanualApiKeyAuthType"
        elasticPipeline:
          type: string
          title: Elastic pipeline
          description: Optional Elastic Cloud Destination pipeline
        includeDocId:
          type: boolean
          title: Include document _id
          description: Include the `document_id` field when sending events to an Elastic
            TSDS (time series data stream)
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_index:
          type: string
          description: Binds 'index' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'index' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_elasticPipeline:
          type: string
          description: Binds 'elasticPipeline' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'elasticPipeline' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputNewrelic:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - newrelic
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        region:
          $ref: "#/components/schemas/RegionOptions"
        logType:
          type: string
          title: Log type
          description: "Name of the logtype to send with events, e.g.: observability,
            access_log. The event's 'sourcetype' field (if set) will override
            this value."
        messageField:
          type: string
          title: Log message field
          description: Name of field to send as log message value. If not present, event
            will be serialized and sent as JSON.
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          maxItems: 4
          items:
            type: object
            required:
              - name
              - value
            properties:
              name:
                type: string
                title: Field Name
                enum:
                  - service
                  - hostname
                  - timestamp
                  - auditId
                x-speakeasy-unknown-values: allow
              value:
                type: string
                title: Value
                description: JavaScript expression to compute field's value, enclosed in quotes
                  or backticks. (Can evaluate to a constant.)
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1
          maximum: 1024
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsApi"
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        description:
          type: string
          title: Description
        customUrl:
          type: string
          pattern: ^https?://.*
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        apiKey:
          type: string
          title: API key
          description: New Relic API key. Can be overridden using __newRelic_apiKey field.
        textSecret:
          type: string
          title: API key (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_logType:
          type: string
          description: Binds 'logType' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'logType' at runtime.
        __template_messageField:
          type: string
          description: Binds 'messageField' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'messageField' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
      required:
        - type
    OutputNewrelicEvents:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - newrelic_events
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        region:
          $ref: "#/components/schemas/RegionOptions"
        accountId:
          type: string
          title: Account ID
          description: New Relic account ID
        eventType:
          type: string
          title: Event type
          description: Default New Relic eventType to use when event type is not present.
            For more information, see the [New Relic eventType
            documentation](https://docs.newrelic.com/docs/telemetry-data-platform/custom-data/custom-events/data-requirements-limits-custom-event-data/#reserved-words).
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1
          maximum: 1024
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsApi"
        description:
          type: string
          title: Description
        customUrl:
          type: string
          pattern: ^https?://.*
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        apiKey:
          type: string
          title: API key
          description: New Relic API key. Can be overridden using __newRelic_apiKey field.
        textSecret:
          type: string
          title: API key (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_accountId:
          type: string
          description: Binds 'accountId' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'accountId' at runtime.
        __template_eventType:
          type: string
          description: Binds 'eventType' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'eventType' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_customUrl:
          type: string
          description: Binds 'customUrl' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'customUrl' at runtime.
      required:
        - type
        - accountId
        - eventType
    OutputInfluxdb:
      type: object
      required:
        - type
        - url
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - influxdb
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        url:
          type: string
          title: Write API URL
          description: URL of an InfluxDB cluster to send events to, e.g.,
            http://localhost:8086/write
          pattern: ^https?://.*
        useV2API:
          type: boolean
          title: Use v2 API
          description: The v2 API can be enabled with InfluxDB versions 1.8 and later.
        timestampPrecision:
          type: string
          title: Timestamp precision
          description: Sets the precision for the supplied Unix time values. Defaults to
            milliseconds.
          enum:
            - ns
            - u
            - ms
            - s
            - m
            - h
          x-speakeasy-enum-descriptions:
            - Nanoseconds
            - Microseconds
            - Milliseconds
            - Seconds
            - Minutes
            - Hours
          x-speakeasy-unknown-values: allow
        dynamicValueFieldName:
          type: boolean
          title: Dynamic value fields
          description: Enabling this will pull the value field from the metric name. E,g,
            'db.query.user' will use 'db.query' as the measurement and 'user' as
            the value field.
        valueFieldName:
          type: string
          title: Value field name
          description: Name of the field in which to store the metric when sending to
            InfluxDB. If dynamic generation is enabled and fails, this will be
            used as a fallback.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 51200
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          type: string
          title: Authentication type
          description: InfluxDB authentication type
          enum:
            - none
            - basic
            - credentialsSecret
            - token
            - textSecret
          x-speakeasy-enum-descriptions:
            - None
            - Basic
            - Basic (credentials secret)
            - Token
            - Token (text secret)
          x-speakeasy-unknown-values: allow
        description:
          type: string
          title: Description
        database:
          type: string
          title: Database
          description: Database to write to.
        bucket:
          type: string
          title: Bucket
          description: Bucket to write to.
        org:
          type: string
          title: Organization
          description: Organization ID for this bucket.
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        token:
          type: string
          title: Token
          description: Bearer token to include in the authorization header
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        textSecret:
          type: string
          title: Token (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_database:
          type: string
          description: Binds 'database' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'database' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
    OutputCloudwatch:
      type: object
      required:
        - type
        - logGroupName
        - logStreamName
        - region
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - cloudwatch
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        logGroupName:
          type: string
          title: Log group name
          description: CloudWatch log group to associate events with
        logStreamName:
          type: string
          title: Log stream prefix
          description: "Prefix for CloudWatch log stream name. This prefix will be used to
            generate a unique log stream name per cribl instance, for example:
            myStream_myHost_myOutputId"
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: Region where the CloudWatchLogs is located
        endpoint:
          type: string
          title: Endpoint
          description: CloudWatchLogs service endpoint. If empty, defaults to the AWS
            Region-specific endpoint. Otherwise, it must point to
            CloudWatchLogs-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        enableAssumeRole:
          type: boolean
          title: Enable for CloudWatchLogs
          description: Use Assume Role credentials to access CloudWatchLogs
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        maxQueueSize:
          type: number
          title: Queue size limit
          description: Maximum number of queued batches before blocking
          minimum: 1
          maximum: 32
        maxRecordSizeKB:
          type: number
          title: Record size limit (KB, uncompressed)
          description: Maximum size (KB) of each individual record before compression. For
            non compressible data 1MB is the max recommended size
          minimum: 1
          maximum: 10240
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Max record size.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_logGroupName:
          type: string
          description: Binds 'logGroupName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'logGroupName' at runtime.
        __template_logStreamName:
          type: string
          description: Binds 'logStreamName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'logStreamName' at runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    OutputMinio:
      type: object
      required:
        - type
        - bucket
        - stagePath
        - endpoint
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - minio
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: MinIO bucket name
          description: "Name of the destination MinIO bucket. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at initialization time.
            Example referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        region:
          type: string
          title: Region
          description: Region where the MinIO bucket is located
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        awsSecretKey:
          type: string
          title: Secret key
          description: "Secret key. This value can be a constant or a JavaScript
            expression. Example: `${C.env.SOME_SECRET}`)"
        endpoint:
          type: string
          title: MinIO endpoint
          description: MinIO service url (e.g. http://minioHost:9000)
          pattern: ^https?://.*
        objectACL:
          $ref: "#/components/schemas/ObjectAclOptions"
        storageClass:
          $ref: "#/components/schemas/StorageClassOptionsReducedredundancyStandard"
        serverSideEncryption:
          $ref: "#/components/schemas/ServerSideEncryptionForUploadedObjectsOptionsAes256"
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: This value can be a constant or a JavaScript expression
            (`${C.env.SOME_ACCESS_KEY}`)
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_objectACL:
          type: string
          description: Binds 'objectACL' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'objectACL' at runtime.
        __template_storageClass:
          type: string
          description: Binds 'storageClass' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'storageClass' at runtime.
        __template_serverSideEncryption:
          type: string
          description: Binds 'serverSideEncryption' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'serverSideEncryption' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputStatsd:
      type: object
      required:
        - type
        - protocol
        - host
        - port
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - statsd
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        protocol:
          $ref: "#/components/schemas/DestinationProtocolOptions"
        host:
          type: string
          title: Host
          description: The hostname of the destination.
        port:
          type: number
          title: Port
          minimum: 1
          maximum: 65535
          description: Destination port.
        mtu:
          type: number
          minimum: 1
          maximum: 65535
          title: Record size limit (bytes)
          description: When protocol is UDP, specifies the maximum size of packets sent to
            the destination. Also known as the MTU for the network path to the
            destination system.
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: When protocol is TCP, specifies how often buffers should be
            flushed, resulting in records sent to the destination.
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (sec)
          description: How often to resolve the destination hostname to an IP address.
            Ignored if the destination is an IP address. A value of 0 means
            every batch sent will incur a DNS lookup.
        description:
          type: string
          title: Description
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        writeTimeout:
          type: number
          title: Write timeout
          description: Amount of time (milliseconds) to wait for a write to complete
            before assuming connection is dead
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputStatsdExt:
      type: object
      required:
        - type
        - protocol
        - host
        - port
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - statsd_ext
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        protocol:
          $ref: "#/components/schemas/DestinationProtocolOptions"
        host:
          type: string
          title: Host
          description: The hostname of the destination.
        port:
          type: number
          title: Port
          minimum: 1
          maximum: 65535
          description: Destination port.
        mtu:
          type: number
          minimum: 1
          maximum: 65535
          title: Record size limit (bytes)
          description: When protocol is UDP, specifies the maximum size of packets sent to
            the destination. Also known as the MTU for the network path to the
            destination system.
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: When protocol is TCP, specifies how often buffers should be
            flushed, resulting in records sent to the destination.
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (sec)
          description: How often to resolve the destination hostname to an IP address.
            Ignored if the destination is an IP address. A value of 0 means
            every batch sent will incur a DNS lookup.
        description:
          type: string
          title: Description
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        writeTimeout:
          type: number
          title: Write timeout
          description: Amount of time (milliseconds) to wait for a write to complete
            before assuming connection is dead
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputGraphite:
      type: object
      required:
        - type
        - protocol
        - host
        - port
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - graphite
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        protocol:
          $ref: "#/components/schemas/DestinationProtocolOptions"
        host:
          type: string
          title: Host
          description: The hostname of the destination.
        port:
          type: number
          title: Port
          minimum: 1
          maximum: 65535
          description: Destination port.
        mtu:
          type: number
          minimum: 1
          maximum: 65535
          title: Record size limit (bytes)
          description: When protocol is UDP, specifies the maximum size of packets sent to
            the destination. Also known as the MTU for the network path to the
            destination system.
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: When protocol is TCP, specifies how often buffers should be
            flushed, resulting in records sent to the destination.
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (sec)
          description: How often to resolve the destination hostname to an IP address.
            Ignored if the destination is an IP address. A value of 0 means
            every batch sent will incur a DNS lookup.
        description:
          type: string
          title: Description
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        writeTimeout:
          type: number
          title: Write timeout
          description: Amount of time (milliseconds) to wait for a write to complete
            before assuming connection is dead
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputRouter:
      type: object
      required:
        - type
        - rules
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - router
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        rules:
          type: array
          title: Rules
          description: Event routing rules
          minItems: 1
          items:
            type: object
            required:
              - filter
              - output
            properties:
              filter:
                type: string
                title: Filter Expression
                description: JavaScript expression to select events to send to output
              output:
                type: string
                title: Output
                description: Output to send matching events to
              description:
                type: string
                title: Description
                description: Description of this rule's purpose
              final:
                type: boolean
                title: Final
                description: Flag to control whether to stop the event from being checked
                  against other rules
        description:
          type: string
          title: Description
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    OutputSns:
      type: object
      required:
        - type
        - topicArn
        - messageGroupId
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - sns
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        topicArn:
          type: string
          title: Topic ARN
          description: "The ARN of the SNS topic to send events to. When a non-AWS URL is
            specified, format must be: '{url}/myQueueName'. E.g.,
            'https://host:port/myQueueName'. Must be a JavaScript expression
            (which can evaluate to a constant value), enclosed in quotes or
            backticks. Can be evaluated only at initialization time. Example
            referencing a Global Variable:
            `https://host:port/myQueue-${C.vars.myVar}`"
        messageGroupId:
          type: string
          title: Message Group ID
          description: "Messages in the same group are processed in a FIFO manner. Must be
            a JavaScript expression (which can evaluate to a constant value),
            enclosed in quotes or backticks. Can be evaluated only at init time.
            Example referencing a Global Variable:
            `https://host:port/myQueue-${C.vars.myVar}`."
        maxRetries:
          type: number
          title: Maximum number of retries
          description: Maximum number of retries before the output returns an error. Note
            that not all errors are retryable. The retries use an exponential
            backoff policy.
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: Region where the SNS is located
        endpoint:
          type: string
          title: Endpoint
          description: SNS service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to SNS-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        enableAssumeRole:
          type: boolean
          title: Enable for SNS
          description: Use Assume Role credentials to access SNS
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_topicArn:
          type: string
          description: Binds 'topicArn' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topicArn' at runtime.
        __template_messageGroupId:
          type: string
          description: Binds 'messageGroupId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'messageGroupId' at
            runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    OutputSqs:
      type: object
      required:
        - type
        - queueName
        - queueType
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - sqs
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        queueName:
          type: string
          title: Queue Name
          description: "The name, URL, or ARN of the SQS queue to send events to. When a
            non-AWS URL is specified, format must be: '{url}/myQueueName'.
            Example: 'https://host:port/myQueueName'. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable:
            `https://host:port/myQueue-${C.vars.myVar}`."
        queueType:
          title: Queue Type
          type: string
          description: The queue type used (or created). Defaults to Standard.
          enum:
            - standard
            - fifo
          x-speakeasy-enum-descriptions:
            - Standard
            - FIFO
          x-speakeasy-unknown-values: allow
        awsAccountId:
          title: AWS account ID
          description: SQS queue owner's AWS account ID. Leave empty if SQS queue is in
            same AWS account.
          type: string
        messageGroupId:
          type: string
          title: Message Group ID
          description: This parameter applies only to FIFO queues. The tag that specifies
            that a message belongs to a specific message group. Messages that
            belong to the same message group are processed in a FIFO manner. Use
            event field __messageGroupId to override this value.
        createQueue:
          type: boolean
          title: Create Queue
          description: Create queue if it does not exist.
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        awsSecretKey:
          type: string
          title: Secret key
        region:
          type: string
          title: Region
          description: AWS Region where the SQS queue is located. Required, unless the
            Queue entry is a URL or ARN that includes a Region.
        endpoint:
          type: string
          title: Endpoint
          description: SQS service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to SQS-compatible endpoint.
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        enableAssumeRole:
          type: boolean
          title: Enable for SQS
          description: Use Assume Role credentials to access SQS
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        maxQueueSize:
          type: number
          title: Queue size limit
          description: Maximum number of queued batches before blocking.
          minimum: 1
        maxRecordSizeKB:
          type: number
          title: Record size limit (KB)
          description: Maximum size (KB) of batches to send. Per the SQS spec, the max
            allowed value is 256 KB.
          minimum: 1
          maximum: 256
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Max record size.
        maxInProgress:
          type: number
          title: Concurrent request limit
          description: The maximum number of in-progress API requests before backpressure
            is applied.
          minimum: 1
          maximum: 100
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: ""
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_queueName:
          type: string
          description: Binds 'queueName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'queueName' at runtime.
        __template_queueType:
          type: string
          description: Binds 'queueType' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'queueType' at runtime.
        __template_awsAccountId:
          type: string
          description: Binds 'awsAccountId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsAccountId' at runtime.
        __template_messageGroupId:
          type: string
          description: Binds 'messageGroupId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'messageGroupId' at
            runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
    OutputSnmp:
      type: object
      required:
        - type
        - hosts
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - snmp
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        hosts:
          type: array
          title: SNMP Trap Destinations
          description: One or more SNMP destinations to forward traps to
          minItems: 1
          items:
            type: object
            required:
              - host
              - port
            properties:
              host:
                type: string
                title: Address
                description: Destination host
              port:
                type: number
                title: Port
                maximum: 65535
                description: Destination port, default is 162
              __template_host:
                type: string
                description: Binds 'host' to a variable for dynamic value resolution. Set to
                  variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                  (group-scoped). Variable value overrides 'host' at runtime.
              __template_port:
                type: string
                description: Binds 'port' to a variable for dynamic value resolution. Set to
                  variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                  (group-scoped). Variable value overrides 'port' at runtime.
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (sec)
          description: How often to resolve the destination hostname to an IP address.
            Ignored if all destinations are IP addresses. A value of 0 means
            every trap sent will incur a DNS lookup.
        description:
          type: string
          title: Description
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    OutputSumoLogic:
      type: object
      required:
        - type
        - url
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - sumo_logic
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        url:
          type: string
          title: API URL
          description: Sumo Logic HTTP collector URL to which events should be sent
          pattern: ^https?://.*
        customSource:
          type: string
          title: Custom source name
          description: Override the source name configured on the Sumo Logic HTTP
            collector. This can also be overridden at the event level with the
            __sourceName field.
        customCategory:
          type: string
          title: Custom source category
          description: Override the source category configured on the Sumo Logic HTTP
            collector. This can also be overridden at the event level with the
            __sourceCategory field.
        format:
          type: string
          title: Data format
          description: Preserve the raw event format instead of JSONifying it
          enum:
            - json
            - raw
          x-speakeasy-enum-descriptions:
            - JSON
            - Raw
          x-speakeasy-unknown-values: allow
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1
          maximum: 1024
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        description:
          type: string
          title: Description
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputDatadog:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - datadog
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        contentType:
          type: string
          title: Send logs as
          description: The content type to use when sending logs
          enum:
            - text
            - json
          x-speakeasy-enum-descriptions:
            - text/plain
            - application/json
          x-speakeasy-unknown-values: allow
        message:
          type: string
          title: Message field
          description: Name of the event field that contains the message to send. If not
            specified, Stream sends a JSON representation of the whole event.
        source:
          type: string
          title: Source
          description: Name of the source to send with logs. When you send logs as JSON
            objects, the event's 'source' field (if set) will override this
            value.
        host:
          type: string
          title: Host
          description: Name of the host to send with logs. When you send logs as JSON
            objects, the event's 'host' field (if set) will override this value.
        service:
          type: string
          title: Service
          description: Name of the service to send with logs. When you send logs as JSON
            objects, the event's '__service' field (if set) will override this
            value.
        tags:
          type: array
          title: Datadog tags
          description: List of tags to send with logs, such as 'env:prod' and
            'env_staging:east'
          items:
            type: string
        batchByTags:
          type: boolean
          title: Batch by tags
          description: Batch events by API key and the ddtags field on the event. When
            disabled, batches events only by API key. If incoming events have
            high cardinality in the ddtags field, disabling this setting may
            improve Destination performance.
        allowApiKeyFromEvents:
          type: boolean
          title: Allow API key from events
          description: Allow API key to be set from the event's '__agent_api_key' field
        severity:
          type: string
          title: Severity
          description: Default value for message severity. When you send logs as JSON
            objects, the event's '__severity' field (if set) will override this
            value.
          enum:
            - emergency
            - alert
            - critical
            - error
            - warning
            - notice
            - info
            - debug
          x-speakeasy-enum-descriptions:
            - emergency
            - alert
            - critical
            - error
            - warning
            - notice
            - info
            - debug
          x-speakeasy-unknown-values: allow
        site:
          type: string
          title: Datadog site
          description: Datadog site to which events should be sent
          enum:
            - us
            - us3
            - us5
            - eu
            - fed1
            - ap1
            - custom
          x-speakeasy-enum-descriptions:
            - US
            - US3
            - US5
            - Europe
            - US1-FED
            - AP1
            - Custom
          x-speakeasy-unknown-values: allow
        sendCountersAsCount:
          type: boolean
          title: Send counter metrics as 'count'
          description: If not enabled, Datadog will transform 'counter' metrics to
            'gauge'. [Learn more about Datadog metrics
            types.](https://docs.datadoghq.com/metrics/types/?tab=count)
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsApi"
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        description:
          type: string
          title: Description
        customUrl:
          type: string
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        apiKey:
          type: string
          title: API key
          description: Organization's API key in Datadog
        textSecret:
          type: string
          title: API key (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_tags:
          type: string
          description: Binds 'tags' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
      required:
        - type
    OutputGrafanaCloud:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - grafana_cloud
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards. These fields are added as dimensions and labels to
            generated metrics and logs, respectively.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        lokiUrl:
          type: string
          title: Loki URL
          description: The endpoint to send logs to, such as
            https://logs-prod-us-central1.grafana.net
          pattern: ^https?://
        prometheusUrl:
          type: string
          title: Prometheus URL
          description: The remote_write endpoint to send Prometheus metrics to, such as
            https://prometheus-blocks-prod-us-central1.grafana.net/api/prom/push
          pattern: ^https?://
        message:
          type: string
          title: Logs message field
          description: Name of the event field that contains the message to send. If not
            specified, Stream sends a JSON representation of the whole event.
        messageFormat:
          $ref: "#/components/schemas/MessageFormatOptions"
        labels:
          type: array
          title: Logs labels
          description: "List of labels to send with logs. Labels define Loki streams, so
            use static labels to avoid proliferating label value combinations
            and streams. Can be merged and/or overridden by the event's __labels
            field. Example: '__labels: {host: \"cribl.io\", level: \"error\"}'"
          minItems: 0
          items:
            $ref: "#/components/schemas/HttpDiscoveryHeaderConfInputPrometheus"
        metricRenameExpr:
          type: string
          title: Metrics renaming expression
          description: JavaScript expression that can be used to rename metrics. For
            example, name.replace(/\./g, '_') will replace all '.' characters in
            a metric's name with the supported '_' character. Use the 'name'
            global variable to access the metric's name. You can access event
            fields' values via __e.<fieldName>.
        prometheusAuth:
          $ref: "#/components/schemas/PrometheusAuthType"
        lokiAuth:
          $ref: "#/components/schemas/PrometheusAuthType"
        concurrency:
          type: number
          title: Request concurrency
          description: "Maximum number of ongoing requests before blocking. Warning:
            Setting this value > 1 can cause Loki and Prometheus to complain
            about entries being delivered out of order."
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: "Maximum size, in KB, of the request body. Warning: Setting this
            too low can increase the number of ongoing requests (depending on
            the value of 'Request concurrency'); this can cause Loki and
            Prometheus to complain about entries being delivered out of order."
          minimum: 1024
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: "Maximum number of events to include in the request body. Default
            is 0 (unlimited). Warning: Setting this too low can increase the
            number of ongoing requests (depending on the value of 'Request
            concurrency'); this can cause Loki and Prometheus to complain about
            entries being delivered out of order."
          minimum: 0
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: "Maximum time between requests. Small values could cause the
            payload size to be smaller than the configured Maximum time between
            requests. Small values can reduce the payload size below the
            configured 'Max record size' and 'Max events per request'. Warning:
            Setting this too low can increase the number of ongoing requests
            (depending on the value of 'Request concurrency'); this can cause
            Loki and Prometheus to complain about entries being delivered out of
            order."
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending. Applies only to JSON
            payloads; the Protobuf variant for both Prometheus and Loki are
            snappy-compressed by default.
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_lokiUrl:
          type: string
          description: Binds 'lokiUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'lokiUrl' at runtime.
        __template_prometheusUrl:
          type: string
          description: Binds 'prometheusUrl' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'prometheusUrl' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
      anyOf:
        - required:
            - lokiUrl
        - required:
            - prometheusUrl
      required:
        - type
    OutputLoki:
      type: object
      required:
        - type
        - url
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - loki
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards. These fields are added as labels to generated logs.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        url:
          type: string
          title: Loki URL
          description: The endpoint to send logs to
          pattern: ^https?://.*
        message:
          type: string
          title: Logs message field
          description: Name of the event field that contains the message to send. If not
            specified, Stream sends a JSON representation of the whole event.
        messageFormat:
          $ref: "#/components/schemas/MessageFormatOptions"
        labels:
          type: array
          title: Logs labels
          description: "List of labels to send with logs. Labels define Loki streams, so
            use static labels to avoid proliferating label value combinations
            and streams. Can be merged and/or overridden by the event's __labels
            field. Example: '__labels: {host: \"cribl.io\", level: \"error\"}'"
          minItems: 0
          items:
            $ref: "#/components/schemas/HttpDiscoveryHeaderConfInputPrometheus"
        authType:
          $ref: "#/components/schemas/AuthenticationTypeOptionsPrometheusAuthBasicCredent\
            ialsSecret"
        concurrency:
          type: number
          title: Request concurrency
          description: "Maximum number of ongoing requests before blocking. Warning:
            Setting this value > 1 can cause Loki to complain about entries
            being delivered out of order."
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: "Maximum size, in KB, of the request body. Warning: Setting this
            too low can increase the number of ongoing requests (depending on
            the value of 'Request concurrency'); this can cause Loki to complain
            about entries being delivered out of order."
          minimum: 1024
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: "Maximum number of events to include in the request body. Defaults
            to 0 (unlimited). Warning: Setting this too low can increase the
            number of ongoing requests (depending on the value of 'Request
            concurrency'); this can cause Loki to complain about entries being
            delivered out of order."
          minimum: 0
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: "Maximum time between requests. Small values could cause the
            payload size to be smaller than the configured Maximum time between
            requests. Small values can reduce the payload size below the
            configured 'Max record size' and 'Max events per request'. Warning:
            Setting this too low can increase the number of ongoing requests
            (depending on the value of 'Request concurrency'); this can cause
            Loki to complain about entries being delivered out of order."
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        enableDynamicHeaders:
          type: boolean
          title: Enable dynamic headers
          description: Add per-event HTTP headers from the __headers field to outgoing
            requests. Events with different headers are batched and sent
            separately.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        description:
          type: string
          title: Description
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        token:
          type: string
          title: Auth token
          description: "Bearer token to include in the authorization header. In Grafana
            Cloud, this is generally built by concatenating the username and the
            API key, separated by a colon. Example:
            <your-username>:<your-api-key>"
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        username:
          type: string
          title: Username
          description: Username for authentication
        password:
          type: string
          title: Password
          description: Password (API key in Grafana Cloud domain) for authentication
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputPrometheus:
      type: object
      required:
        - type
        - url
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - prometheus
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards. These fields are added as dimensions to generated
            metrics.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        url:
          type: string
          title: Remote Write URL
          description: The endpoint to send metrics to
          pattern: ^https?://.*
        metricRenameExpr:
          type: string
          title: Metric renaming expression
          description: JavaScript expression that can be used to rename metrics. For
            example, name.replace(/\./g, '_') will replace all '.' characters in
            a metric's name with the supported '_' character. Use the 'name'
            global variable to access the metric's name. You can access event
            fields' values via __e.<fieldName>.
        sendMetadata:
          type: boolean
          title: Send metadata
          description: Generate and send metadata (`type` and `metricFamilyName`) requests
        usePrometheusHistogramBucketSuffix:
          type: boolean
          title: Use `_bucket` suffix for histogram buckets
          description: Serialize histogram bucket series as `<metric>_bucket` to match
            Prometheus histogram naming convention
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          $ref: "#/components/schemas/AuthenticationTypeOptionsPrometheusAuth"
        description:
          type: string
          title: Description
        metricsFlushPeriodSec:
          type: number
          title: Metadata flush period (sec)
          description: How frequently metrics metadata is sent out. Value cannot be
            smaller than the base Flush period set above.
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        token:
          type: string
          title: Token
          description: Bearer token to include in the authorization header
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        textSecret:
          type: string
          title: Token (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputRing:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - ring
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        format:
          type: string
          title: Data format
          description: Format of the output data.
          enum:
            - json
            - raw
          x-speakeasy-unknown-values: allow
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JS expression to define how files are partitioned and organized. If
            left blank, Cribl Stream will fallback on event.__partition.
        maxDataSize:
          type: string
          title: Data size limit
          description: "Maximum disk space allowed to be consumed (examples: 420MB, 4GB).
            When limit is reached, older data will be deleted."
          pattern: ^\d+\s*(?:\w{2})?$
        maxDataTime:
          title: Data age limit
          type: string
          description: "Maximum amount of time to retain data (examples: 2h, 4d). When
            limit is reached, older data will be deleted."
          pattern: \d+[smhd]$
        compress:
          $ref: "#/components/schemas/DataCompressionFormatOptionsPersistence"
        destPath:
          type: string
          title: Path location
          description: Path to use to write metrics. Defaults to $CRIBL_HOME/state/<id>
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        description:
          type: string
          title: Description
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
      required:
        - type
    OutputOpenTelemetry:
      type: object
      required:
        - type
        - endpoint
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - open_telemetry
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        protocol:
          $ref: "#/components/schemas/ProtocolOptions"
        endpoint:
          type: string
          title: Endpoint
          description: The endpoint where OTel events will be sent. Enter any valid URL or
            an IP address (IPv4 or IPv6; enclose IPv6 addresses in square
            brackets). Unspecified ports will default to 4317, unless the
            endpoint is an HTTPS-based URL or TLS is enabled, in which case 443
            will be used.
        otlpVersion:
          type: string
          title: OTLP version
          description: The version of OTLP Protobuf definitions to use when structuring
            data to send
          enum:
            - 0.10.0
            - 1.3.1
          x-speakeasy-enum-descriptions:
            - 0.10.0
            - 1.3.1
          x-speakeasy-unknown-values: allow
        compress:
          $ref: "#/components/schemas/CompressionOptionsDeflateGzip"
        httpCompress:
          $ref: "#/components/schemas/CompressionOptionsMessages"
        authType:
          type: string
          title: Authentication type
          enum:
            - none
            - basic
            - credentialsSecret
            - token
            - textSecret
            - oauthSecret
          x-speakeasy-enum-descriptions:
            - None
            - Basic
            - Basic (credentials secret)
            - Token
            - Token (text secret)
            - OAuth (text secret)
          x-speakeasy-unknown-values: allow
        httpTracesEndpointOverride:
          type: string
          title: Traces endpoint override
          description: If you want to send traces to the default `{endpoint}/v1/traces`
            endpoint, leave this field empty; otherwise, specify the desired
            endpoint
        httpMetricsEndpointOverride:
          type: string
          title: Metrics endpoint override
          description: If you want to send metrics to the default `{endpoint}/v1/metrics`
            endpoint, leave this field empty; otherwise, specify the desired
            endpoint
        httpLogsEndpointOverride:
          type: string
          title: Logs endpoint override
          description: If you want to send logs to the default `{endpoint}/v1/logs`
            endpoint, leave this field empty; otherwise, specify the desired
            endpoint
        metadata:
          type: array
          title: Metadata
          description: List of key-value pairs to send with each gRPC request. Value
            supports JavaScript expressions that are evaluated just once, when
            the destination gets started. To pass credentials as metadata, use
            'C.Secret'.
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        dynamicHeadersEnabled:
          type: boolean
          title: Use dynamic metadata
          description: Batch event data upon dynamic metadata (whether presented or not)
        dynamicHeadersField:
          type: string
          title: Dynamic metadata field
          description: When presented, this field which contains metadata, will be
            injected into the Destination metadata and used to batch events.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 10240
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often the sender should ping the peer to keep the connection open
          minimum: 1
        keepAlive:
          type: boolean
          title: Keep alive
          description: Disable to close the connection immediately after sending the
            outgoing request
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        token:
          type: string
          title: Token
          description: Bearer token to include in the authorization header
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        textSecret:
          type: string
          title: Token (text secret)
          description: Select or create a stored text secret
        loginUrl:
          type: string
          title: Login URL
          description: URL for OAuth
          pattern: ^https?://.*
        secretParamName:
          type: string
          title: OAuth Secret parameter name
          description: Secret parameter name to pass in request body
        oauthTextSecret:
          type: string
          title: OAuth secret (text secret)
          description: Select or create a stored text secret for the OAuth secret
            parameter value to pass in request body
        tokenAttributeName:
          type: string
          title: Token attribute name
          description: Name of the auth token attribute in the OAuth response. Can be
            top-level (e.g., 'token'); or nested, using a period (e.g.,
            'data.token').
        authHeaderExpr:
          type: string
          title: Authorize expression
          description: "JavaScript expression to compute the Authorization header value to
            pass in requests. The value `${token}` is used to reference the
            token obtained from authentication, e.g.: `Bearer ${token}`."
        tokenTimeoutSecs:
          type: number
          title: Refresh interval (secs.)
          description: How often the OAuth token should be refreshed.
          minimum: 1
          maximum: 300000
        oauthParams:
          type: array
          title: OAuth parameters
          description: Additional parameters to send in the OAuth login request.
            @{product} will combine the secret with these parameters, and will
            send the URL-encoded result in a POST request to the endpoint
            specified in the 'Login URL'. We'll automatically add the
            content-type header 'application/x-www-form-urlencoded' when sending
            this request.
          items:
            $ref: "#/components/schemas/OauthParamConfInputServicenowTable"
        oauthHeaders:
          type: array
          title: OAuth headers
          description: Additional headers to send in the OAuth login request. @{product}
            will automatically add the content-type header
            'application/x-www-form-urlencoded' when sending this request.
          items:
            $ref: "#/components/schemas/OauthHeaderConfInputServicenowTable"
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeExtended"
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_loginUrl:
          type: string
          description: Binds 'loginUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'loginUrl' at runtime.
    OutputServiceNow:
      type: object
      required:
        - type
        - endpoint
        - protocol
        - otlpVersion
        - tokenSecret
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - service_now
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        endpoint:
          type: string
          title: Endpoint
          description: The endpoint where ServiceNow events will be sent. Enter any valid
            URL or an IP address (IPv4 or IPv6; enclose IPv6 addresses in square
            brackets)
        tokenSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        authTokenName:
          type: string
          title: Auth token name
        otlpVersion:
          $ref: "#/components/schemas/OtlpVersionOptions131"
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 10240
        protocol:
          $ref: "#/components/schemas/ProtocolOptions"
        compress:
          $ref: "#/components/schemas/CompressionOptionsDeflateGzip"
        httpCompress:
          $ref: "#/components/schemas/CompressionOptionsMessages"
        httpTracesEndpointOverride:
          type: string
          title: Traces endpoint override
          description: If you want to send traces to the default `{endpoint}/v1/traces`
            endpoint, leave this field empty; otherwise, specify the desired
            endpoint
        httpMetricsEndpointOverride:
          type: string
          title: Metrics endpoint override
          description: If you want to send metrics to the default `{endpoint}/v1/metrics`
            endpoint, leave this field empty; otherwise, specify the desired
            endpoint
        httpLogsEndpointOverride:
          type: string
          title: Logs endpoint override
          description: If you want to send logs to the default `{endpoint}/v1/logs`
            endpoint, leave this field empty; otherwise, specify the desired
            endpoint
        metadata:
          type: array
          title: Metadata
          description: List of key-value pairs to send with each gRPC request. Value
            supports JavaScript expressions that are evaluated just once, when
            the destination gets started. To pass credentials as metadata, use
            'C.Secret'.
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        dynamicHeadersEnabled:
          type: boolean
          title: Use dynamic metadata
          description: Batch event data upon dynamic metadata (whether presented or not)
        dynamicHeadersField:
          type: string
          title: Dynamic metadata field
          description: When presented, this field which contains metadata, will be
            injected into the Destination metadata and used to batch events.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often the sender should ping the peer to keep the connection open
          minimum: 1
        keepAlive:
          type: boolean
          title: Keep alive
          description: Disable to close the connection immediately after sending the
            outgoing request
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeExtended"
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputDataset:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - dataset
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        messageField:
          type: string
          title: Message field
          description: Name of the event field that contains the message or attributes to
            send. If not specified, all of the event's non-internal fields will
            be sent as attributes.
        excludeFields:
          type: array
          title: Exclude fields
          description: Fields to exclude from the event if the Message field is either
            unspecified or refers to an object. Ignored if the Message field is
            a string. If empty, we send all non-internal fields.
          items:
            type: string
        serverHostField:
          type: string
          title: Server/host field
          description: Name of the event field that contains the `serverHost` identifier.
            If not specified, defaults to `cribl_<outputId>`.
        timestampField:
          type: string
          title: Timestamp field
          description: Name of the event field that contains the timestamp. If not
            specified, defaults to `ts`, `_time`, or `Date.now()`, in that
            order.
        defaultSeverity:
          type: string
          title: Severity
          description: Default value for event severity. If the `sev` or `__severity`
            fields are set on an event, the first one matching will override
            this value.
          enum:
            - finest
            - finer
            - fine
            - info
            - warning
            - error
            - fatal
          x-speakeasy-enum-descriptions:
            - 0 - finest
            - 1 - finer
            - 2 - fine
            - 3 - info
            - 4 - warning
            - 5 - error
            - 6 - fatal
          x-speakeasy-unknown-values: allow
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        site:
          type: string
          title: DataSet site
          description: DataSet site to which events should be sent
          enum:
            - us
            - eu
            - custom
          x-speakeasy-enum-descriptions:
            - US
            - Europe
            - Custom
          x-speakeasy-unknown-values: allow
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 6144
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsApi"
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        description:
          type: string
          title: Description
        customUrl:
          type: string
          pattern: ^https?://.*
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        apiKey:
          type: string
          title: API key
          description: A 'Log Write Access' API key for the DataSet account
        textSecret:
          type: string
          title: API key (text secret)
          description: Select or create a stored text secret
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_customUrl:
          type: string
          description: Binds 'customUrl' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'customUrl' at runtime.
      required:
        - type
    OutputCriblTcp:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - cribl_tcp
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        loadBalanced:
          type: boolean
          title: Load balancing
          description: Use load-balanced destinations
        compression:
          $ref: "#/components/schemas/CompressionOptionsGzipNone"
        logFailedRequests:
          type: boolean
          title: Log failed requests to disk
          description: Use to troubleshoot issues with sending data
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        writeTimeout:
          type: number
          title: Write timeout
          description: Amount of time (milliseconds) to wait for a write to complete
            before assuming connection is dead
        tokenTTLMinutes:
          type: number
          title: Auth Token TTL minutes
          minimum: 1
          maximum: 60
          description: The number of minutes before the internally generated
            authentication token expires, valid values between 1 and 60
        authTokens:
          type: array
          title: Connected environment tokens
          description: Shared secrets to be used by connected environments to authorize
            connections. These tokens should also be installed in Cribl TCP
            Source in Cribl.Cloud.
          items:
            $ref: "#/components/schemas/AuthTokenConfInputCriblTcp"
        excludeFields:
          type: array
          title: Exclude fields
          description: "Fields to exclude from the event. By default, all internal fields
            except `__output` are sent. Example: `cribl_pipe`, `c*`. Wildcards
            supported."
          items:
            type: string
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        host:
          type: string
          title: Address
          description: The hostname of the receiver
        port:
          type: number
          title: Port
          maximum: 65535
          description: The port to connect to on the provided host
        excludeSelf:
          type: boolean
          title: Exclude current host IPs
          description: Exclude all IPs of the current host from the list of any resolved
            hostnames
        hosts:
          type: array
          title: Destinations
          description: Set of hosts to load-balance data to
          minItems: 1
          items:
            $ref: "#/components/schemas/HostConfOutputSyslog"
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (seconds)
          description: The interval in which to re-resolve any hostnames and pick up
            destinations from A records
        loadBalanceStatsPeriodSec:
          type: number
          minimum: 10
          title: Load balance stats period (seconds)
          description: How far back in time to keep traffic stats for load balancing
            purposes
        maxConcurrentSenders:
          type: number
          minimum: 0
          title: Connection limit
          description: Maximum number of concurrent connections (per Worker Process). A
            random set of IPs will be picked on every DNS resolution period. Use
            0 for unlimited.
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
      required:
        - type
    OutputCriblHttp:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - cribl_http
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        loadBalanced:
          type: boolean
          title: Load balancing
          description: For optimal performance, enable load balancing even if you have one
            hostname, as it can expand to multiple IPs. If this setting is
            disabled, consider enabling round-robin DNS.
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        tokenTTLMinutes:
          type: number
          title: Auth Token TTL minutes
          minimum: 1
          maximum: 60
          description: The number of minutes before the internally generated
            authentication token expires. Valid values are between 1 and 60.
        excludeFields:
          type: array
          title: Exclude fields
          description: "Fields to exclude from the event. By default, all internal fields
            except `__output` are sent. Example: `cribl_pipe`, `c*`. Wildcards
            supported."
          items:
            type: string
        compression:
          $ref: "#/components/schemas/CompressionOptionsGzipNone"
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        authTokens:
          type: array
          title: Connected environment tokens
          description: Shared secrets to be used by connected environments to authorize
            connections. These tokens should also be installed in Cribl HTTP
            Source in Cribl.Cloud.
          items:
            $ref: "#/components/schemas/AuthTokenConfOutputCriblHttp"
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        url:
          type: string
          title: Cribl endpoint
          description: URL of a Cribl Worker to send events to, such as
            http://localhost:10200
          pattern: ^https?://.*
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        excludeSelf:
          type: boolean
          title: Exclude current host IPs
          description: Exclude all IPs of the current host from the list of any resolved
            hostnames
        urls:
          type: array
          title: Cribl Worker endpoints
          description: ""
          minItems: 1
          items:
            $ref: "#/components/schemas/UrlConfOutputCriblHttp"
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (seconds)
          description: The interval in which to re-resolve any hostnames and pick up
            destinations from A records
        loadBalanceStatsPeriodSec:
          type: number
          minimum: 10
          title: Load balance stats period (seconds)
          description: How far back in time to keep traffic stats for load balancing
            purposes
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
      required:
        - type
    OutputCriblSearchEngine:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - cribl_search_engine
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        loadBalanced:
          type: boolean
          title: Load balancing
          description: For optimal performance, enable load balancing even if you have one
            hostname, as it can expand to multiple IPs. If this setting is
            disabled, consider enabling round-robin DNS.
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        tokenTTLMinutes:
          type: number
          title: Auth Token TTL minutes
          minimum: 1
          maximum: 60
          description: The number of minutes before the internally generated
            authentication token expires. Valid values are between 1 and 60.
        excludeFields:
          type: array
          title: Exclude fields
          description: "Fields to exclude from the event. By default, all internal fields
            except `__output` are sent. Example: `cribl_pipe`, `c*`. Wildcards
            supported."
          items:
            type: string
        compression:
          $ref: "#/components/schemas/CompressionOptionsGzipNone"
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 10240
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        authTokens:
          type: array
          title: Connected environment tokens
          description: Shared secrets to be used by connected environments to authorize
            connections. These tokens should also be installed in Cribl Search
            Source in Cribl.Cloud.
          items:
            $ref: "#/components/schemas/AuthTokenConfOutputCriblHttp"
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        description:
          type: string
          title: Description
        url:
          type: string
          title: Cribl endpoint
          description: URL of a Cribl Worker to send events to, such as
            http://localhost:10200
          pattern: ^https?://.*
        excludeSelf:
          type: boolean
          title: Exclude current host IPs
          description: Exclude all IPs of the current host from the list of any resolved
            hostnames
        urls:
          type: array
          title: Cribl Worker endpoints
          description: ""
          minItems: 1
          items:
            $ref: "#/components/schemas/UrlConfOutputCriblHttp"
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (seconds)
          description: The interval in which to re-resolve any hostnames and pick up
            destinations from A records
        loadBalanceStatsPeriodSec:
          type: number
          minimum: 10
          title: Load balance stats period (seconds)
          description: How far back in time to keep traffic stats for load balancing
            purposes
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
      required:
        - type
    OutputHumioHec:
      type: object
      required:
        - type
        - format
        - url
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - humio_hec
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        url:
          type: string
          title: LogScale endpoint
          description: "URL to a CrowdStrike Falcon LogScale endpoint to send events to.
            Examples: https://cloud.us.humio.com/api/v1/ingest/hec for JSON and
            https://cloud.us.humio.com/api/v1/ingest/hec/raw for raw"
          pattern: ^https?://.*
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 32768
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        format:
          $ref: "#/components/schemas/RequestFormatOptions"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        token:
          type: string
          title: LogScale auth token
          description: CrowdStrike Falcon LogScale authentication token
        textSecret:
          type: string
          title: LogScale auth token (text secret)
          description: Select or create a stored text secret
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputCrowdstrikeNextGenSiem:
      type: object
      required:
        - type
        - format
        - url
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - crowdstrike_next_gen_siem
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        url:
          type: string
          title: Next-Gen SIEM endpoint
          description: |-
            URL provided from a CrowdStrike data connector. 
            Example: https://ingest.<region>.crowdstrike.com/api/ingest/hec/<connection-id>/v1/services/collector
          pattern: ^https?://.*
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 32768
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        format:
          $ref: "#/components/schemas/RequestFormatOptions"
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        token:
          type: string
          title: Next-Gen SIEM authentication token
        textSecret:
          type: string
          title: Next-Gen SIEM authentication token (text secret)
          description: Select or create a stored text secret
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputDlS3:
      type: object
      required:
        - type
        - bucket
        - stagePath
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - dl_s3
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        endpoint:
          type: string
          title: Endpoint
          description: S3 service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to S3-compatible endpoint.
        enableAssumeRole:
          type: boolean
          title: Enable for S3
          description: Use Assume Role credentials to access S3
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: S3 bucket name
          description: "Name of the destination S3 bucket. Must be a JavaScript expression
            (which can evaluate to a constant value), enclosed in quotes or
            backticks. Can be evaluated only at initialization time. Example
            referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        region:
          type: string
          title: Region
          description: Region where the S3 bucket is located
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        awsSecretKey:
          type: string
          title: Secret key
          description: "Secret key. This value can be a constant or a JavaScript
            expression. Example: `${C.env.SOME_SECRET}`)"
        objectACL:
          $ref: "#/components/schemas/ObjectAclOptions"
        storageClass:
          $ref: "#/components/schemas/StorageClassOptions"
        serverSideEncryption:
          $ref: "#/components/schemas/ServerSideEncryptionForUploadedObjectsOptions"
        kmsKeyId:
          type: string
          title: KMS key ID
          description: ID or ARN of the KMS customer-managed key to use for encryption
        partitioningFields:
          type: array
          title: Partition by fields
          description: List of fields to partition the path by, in addition to time, which
            is included automatically. The effective partition will be
            YYYY/MM/DD/HH/<list/of/fields>.
          items:
            type: string
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: This value can be a constant or a JavaScript expression
            (`${C.env.SOME_ACCESS_KEY}`)
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_objectACL:
          type: string
          description: Binds 'objectACL' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'objectACL' at runtime.
        __template_storageClass:
          type: string
          description: Binds 'storageClass' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'storageClass' at runtime.
        __template_serverSideEncryption:
          type: string
          description: Binds 'serverSideEncryption' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'serverSideEncryption' at runtime.
        __template_kmsKeyId:
          type: string
          description: Binds 'kmsKeyId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'kmsKeyId' at runtime.
        __template_partitioningFields:
          type: string
          description: Binds 'partitioningFields' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'partitioningFields' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputSecurityLake:
      type: object
      required:
        - type
        - bucket
        - stagePath
        - region
        - accountId
        - customSource
        - assumeRoleArn
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - security_lake
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards. These fields are added as dimensions and labels to
            generated metrics and logs, respectively.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        endpoint:
          type: string
          title: Endpoint
          description: Amazon Security Lake service endpoint. If empty, defaults to the
            AWS Region-specific endpoint. Otherwise, it must point to Amazon
            Security Lake-compatible endpoint.
        enableAssumeRole:
          type: boolean
          title: Enable for S3
          description: Use Assume Role credentials to access S3
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsS3CollectorConf"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: S3 bucket name
          description: "Name of the destination S3 bucket. Must be a JavaScript expression
            (which can evaluate to a constant value), enclosed in quotes or
            backticks. Can be evaluated only at initialization time. Example
            referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        region:
          type: string
          title: Region
          description: Region where the Amazon Security Lake is located.
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        awsSecretKey:
          type: string
          title: Secret key
        objectACL:
          $ref: "#/components/schemas/ObjectAclOptions"
        storageClass:
          $ref: "#/components/schemas/StorageClassOptions"
        serverSideEncryption:
          $ref: "#/components/schemas/ServerSideEncryptionForUploadedObjectsOptions"
        kmsKeyId:
          type: string
          title: KMS key ID
          description: ID or ARN of the KMS customer-managed key to use for encryption
        accountId:
          type: string
          title: Account ID
          description: ID of the AWS account whose data the Destination will write to
            Security Lake. This should have been configured when creating the
            Amazon Security Lake custom source.
        customSource:
          type: string
          title: Custom source name
          description: Name of the custom source configured in Amazon Security Lake
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        description:
          type: string
          title: Description
        awsApiKey:
          type: string
          title: Access key
          description: This value can be a constant or a JavaScript expression
            (`${C.env.SOME_ACCESS_KEY}`)
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_objectACL:
          type: string
          description: Binds 'objectACL' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'objectACL' at runtime.
        __template_storageClass:
          type: string
          description: Binds 'storageClass' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'storageClass' at runtime.
        __template_serverSideEncryption:
          type: string
          description: Binds 'serverSideEncryption' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'serverSideEncryption' at runtime.
        __template_kmsKeyId:
          type: string
          description: Binds 'kmsKeyId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'kmsKeyId' at runtime.
        __template_accountId:
          type: string
          description: Binds 'accountId' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'accountId' at runtime.
        __template_customSource:
          type: string
          description: Binds 'customSource' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'customSource' at runtime.
        __template_awsApiKey:
          type: string
          description: Binds 'awsApiKey' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsApiKey' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputCriblLake:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - cribl_lake
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        endpoint:
          type: string
          title: Endpoint
          description: S3 service endpoint. If empty, defaults to the AWS Region-specific
            endpoint. Otherwise, it must point to S3-compatible endpoint.
        enableAssumeRole:
          type: boolean
          title: Enable for S3
          description: Use Assume Role credentials to access S3
        assumeRoleArn:
          type: string
          title: AssumeRole ARN
          description: Amazon Resource Name (ARN) of the role to assume
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          title: External ID
          description: External ID to use when assuming role
        durationSeconds:
          type: number
          title: Duration (seconds)
          description: Duration of the assumed role's session, in seconds. Minimum is 900
            (15 minutes), default is 3600 (1 hour), and maximum is 43200 (12
            hours).
          minimum: 900
          maximum: 43200
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: S3 bucket name
          description: "Name of the destination S3 bucket. Must be a JavaScript expression
            (which can evaluate to a constant value), enclosed in quotes or
            backticks. Can be evaluated only at initialization time. Example
            referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        region:
          type: string
          title: Region
          description: Region where the S3 bucket is located
        destPath:
          type: string
          title: Lake dataset
          description: Lake dataset to send the data to.
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        awsSecretKey:
          type: string
          title: Secret key
          description: "Secret key. This value can be a constant or a JavaScript
            expression. Example: `${C.env.SOME_SECRET}`)"
        objectACL:
          $ref: "#/components/schemas/ObjectAclOptions"
        storageClass:
          $ref: "#/components/schemas/StorageClassOptions"
        serverSideEncryption:
          $ref: "#/components/schemas/ServerSideEncryptionForUploadedObjectsOptions"
        kmsKeyId:
          type: string
          title: KMS key ID
          description: ID or ARN of the KMS customer-managed key to use for encryption
        awsAuthenticationMethod:
          type: string
          enum:
            - auto
            - auto_rpc
            - manual
          x-speakeasy-unknown-values: allow
        format:
          type: string
          enum:
            - json
            - parquet
            - ddss
            - netskope
          x-speakeasy-unknown-values: allow
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        description:
          type: string
          title: Description
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_assumeRoleArn:
          type: string
          description: Binds 'assumeRoleArn' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'assumeRoleArn' at runtime.
        __template_assumeRoleExternalId:
          type: string
          description: Binds 'assumeRoleExternalId' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'assumeRoleExternalId' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_objectACL:
          type: string
          description: Binds 'objectACL' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'objectACL' at runtime.
        __template_storageClass:
          type: string
          description: Binds 'storageClass' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'storageClass' at runtime.
        __template_serverSideEncryption:
          type: string
          description: Binds 'serverSideEncryption' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'serverSideEncryption' at runtime.
        __template_kmsKeyId:
          type: string
          description: Binds 'kmsKeyId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'kmsKeyId' at runtime.
      required:
        - type
    OutputDiskSpool:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - disk_spool
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        timeWindow:
          type: string
          title: Bucket time span
          description: Time period for grouping spooled events. Default is 10m.
        maxDataSize:
          type: string
          title: Data size limit
          description: "Maximum disk space that can be consumed before older buckets are
            deleted. Examples: 420MB, 4GB. Default is 1GB."
          pattern: ^\d+(\.\d+)?\s*(?:[kmgKMG](b|B))?$
        maxDataTime:
          title: Data age limit
          type: string
          description: "Maximum amount of time to retain data before older buckets are
            deleted. Examples: 2h, 4d. Default is 24h."
          pattern: \d+[smhd]$
        compress:
          $ref: "#/components/schemas/CompressionOptionsPersistence"
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized within the time-buckets. If blank, the event's __partition
            property is used and otherwise, events go directly into the
            time-bucket directory.
        description:
          type: string
          title: Description
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      required:
        - type
    OutputClickHouse:
      type: object
      required:
        - type
        - database
        - tableName
        - url
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - click_house
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        url:
          type: string
          title: URL
          description: "URL of the ClickHouse instance. Example: http://localhost:8123/"
        authType:
          $ref: "#/components/schemas/AuthenticationTypeOptions"
        database:
          type: string
          title: ClickHouse database
        tableName:
          type: string
          title: ClickHouse table
          description: Name of the ClickHouse table where data will be inserted. Name can
            contain letters (A-Z, a-z), numbers (0-9), and the character "_",
            and must start with either a letter or the character "_".
          pattern: ^[a-zA-Z_][0-9a-zA-Z_]*$
        format:
          type: string
          title: Format
          description: Data format to use when sending data to ClickHouse. Defaults to
            JSON Compact.
          enum:
            - json-compact-each-row-with-names
            - json-each-row
          x-speakeasy-enum-descriptions:
            - JSONCompactEachRowWithNames
            - JSONEachRow
          x-speakeasy-unknown-values: allow
        mappingType:
          type: string
          title: Mapping type
          description: How event fields are mapped to ClickHouse columns
          enum:
            - automatic
            - custom
          x-speakeasy-enum-descriptions:
            - Automatic
            - Custom
          x-speakeasy-unknown-values: allow
        asyncInserts:
          type: boolean
          title: Async inserts
          description: Collect data into batches for later processing on the ClickHouse
            server. Disable to write to a ClickHouse table immediately. Cribl
            sends the configured value with every insert
            (<code>async_insert=1</code> or <code>async_insert=0</code>) so
            behavior is consistent across ClickHouse versions, including 26.3
            LTS and later, where async inserts are enabled by default on the
            server.
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPathExtended"
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 25600
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        workload:
          type: string
          title: Workload
          description: Optional ClickHouse workload name to append as a SETTINGS clause on
            INSERT queries. Used for workload scheduling classification.
        dumpFormatErrorsToDisk:
          type: boolean
          title: Log last schema mismatch
          description: Log the most recent event that fails to match the table schema
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        sqlUsername:
          type: string
          title: Username
          description: Username for certificate authentication
        waitForAsyncInserts:
          type: boolean
          title: Wait for async inserts
          description: Cribl will wait for confirmation that data has been fully inserted
            into the ClickHouse database before proceeding. Disabling this
            option can increase throughput, but Cribl won't be able to verify
            data has been completely inserted.
        excludeMappingFields:
          type: array
          title: Exclude fields
          description: Fields to exclude from sending to ClickHouse
          minItems: 0
          items:
            type: string
            minLength: 0
        describeTable:
          type: string
          title: Retrieve table columns
          description: Retrieves the table schema from ClickHouse and populates the Column
            Mapping table
        columnMappings:
          type: array
          title: Column Mapping
          description: ""
          items:
            type: object
            required:
              - columnName
              - columnValueExpression
            properties:
              columnName:
                type: string
                title: Column name
                description: Name of the column in ClickHouse that will store field value
              columnType:
                type: string
                title: Column type
                description: Type of the column in the ClickHouse database
              columnValueExpression:
                type: string
                title: Column value
                description: JavaScript expression to compute value to be inserted into
                  ClickHouse table
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_database:
          type: string
          description: Binds 'database' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'database' at runtime.
        __template_tableName:
          type: string
          description: Binds 'tableName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tableName' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputLocalSearchStorage:
      type: object
      required:
        - type
        - database
        - tableName
        - url
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - local_search_storage
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        url:
          type: string
          title: URL
          description: "URL of the database instance. Example: http://localhost:8123/"
        authType:
          $ref: "#/components/schemas/AuthenticationTypeOptions"
        database:
          type: string
          title: Database
        tableName:
          type: string
          title: Table
          description: Name of the table where data will be inserted. Name can contain
            letters (A-Z, a-z), numbers (0-9), and the character "_", and must
            start with either a letter or the character "_".
          pattern: ^[a-zA-Z_][0-9a-zA-Z_]*$
        format:
          type: string
          title: Format
          description: Data format to use when sending data. Defaults to JSON Compact.
          enum:
            - json-compact-each-row-with-names
            - json-each-row
          x-speakeasy-enum-descriptions:
            - JSONCompactEachRowWithNames
            - JSONEachRow
          x-speakeasy-unknown-values: allow
        mappingType:
          type: string
          title: Mapping type
          description: How event fields are mapped to columns.
          enum:
            - automatic
            - custom
          x-speakeasy-enum-descriptions:
            - Automatic
            - Custom
          x-speakeasy-unknown-values: allow
        asyncInserts:
          type: boolean
          title: Async inserts
          description: Collect data into batches for later processing. Disable to write to
            a table immediately.
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPathExtended"
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 25600
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        workload:
          type: string
          title: Workload
          description: Optional ClickHouse workload name to append as a SETTINGS clause on
            INSERT queries. Used for workload scheduling classification.
        dumpFormatErrorsToDisk:
          type: boolean
          title: Log last schema mismatch
          description: Log the most recent event that fails to match the table schema
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        statsDestination:
          type: object
          properties:
            url:
              type: string
            database:
              type: string
            tableName:
              type: string
            authType:
              type: string
            username:
              type: string
            sqlUsername:
              type: string
            password:
              type: string
            waitForAsyncInserts:
              type: boolean
            concurrency:
              type: number
        description:
          type: string
          title: Description
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        sqlUsername:
          type: string
          title: Username
          description: Username for certificate authentication
        waitForAsyncInserts:
          type: boolean
          title: Wait for async inserts
          description: Cribl will wait for confirmation that data has been fully inserted
            into the database before proceeding. Disabling this option can
            increase throughput, but Cribl won't be able to verify data has been
            completely inserted.
        excludeMappingFields:
          type: array
          title: Exclude fields
          description: Fields to exclude from sending
          minItems: 0
          items:
            type: string
            minLength: 0
        describeTable:
          type: string
          title: Retrieve table columns
          description: Retrieves the table schema and populates the Column Mapping table
        columnMappings:
          type: array
          title: Column Mapping
          description: ""
          items:
            type: object
            required:
              - columnName
              - columnValueExpression
            properties:
              columnName:
                type: string
                title: Column name
                description: Name of the column that will store field value
              columnType:
                type: string
                title: Column type
                description: Type of the column in the database
              columnValueExpression:
                type: string
                title: Column value
                description: JavaScript expression to compute value to be inserted into the
                  table
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
        __template_database:
          type: string
          description: Binds 'database' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'database' at runtime.
        __template_tableName:
          type: string
          description: Binds 'tableName' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tableName' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputXsiam:
      type: object
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - xsiam
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        loadBalanced:
          type: boolean
          title: Load balancing
          description: Enable for optimal performance. Even if you have one hostname, it
            can expand to multiple IPs. If disabled, consider enabling
            round-robin DNS.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 100
          maximum: 10000
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        authType:
          title: Authentication method
          type: string
          enum:
            - token
            - secret
          description: Enter a token directly, or provide a secret referencing a token
          x-speakeasy-unknown-values: allow
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        throttleRateReqPerSec:
          type: integer
          title: Throttle request rate limit
          description: Maximum number of requests to limit to per second
          maximum: 2000
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        description:
          type: string
          title: Description
        url:
          type: string
          title: XSIAM endpoint
          description: XSIAM endpoint URL to send events to, such as https://api-{tenant
            external URL}/logs/v1/event
          pattern: ^https?://.*
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        excludeSelf:
          type: boolean
          title: Exclude current host IPs
          description: Exclude all IPs of the current host from the list of any resolved
            hostnames
        urls:
          type: array
          title: XSIAM Endpoints
          description: ""
          minItems: 1
          items:
            type: object
            properties:
              weight:
                type: number
                title: Load Weight
                description: Assign a weight (>0) to each endpoint to indicate its
                  traffic-handling capability
                minimum: 0
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (seconds)
          description: The interval in which to re-resolve any hostnames and pick up
            destinations from A records
        loadBalanceStatsPeriodSec:
          type: number
          minimum: 10
          title: Load balance stats period (seconds)
          description: How far back in time to keep traffic stats for load balancing
            purposes
        token:
          type: string
          title: Auth token
          description: XSIAM authentication token
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
      required:
        - type
    OutputNetflow:
      type: object
      required:
        - type
        - hosts
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - netflow
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        hosts:
          type: array
          title: NetFlow Destinations
          description: One or more NetFlow Destinations to forward events to
          minItems: 1
          items:
            type: object
            required:
              - host
              - port
            properties:
              host:
                type: string
                title: Address
                description: Destination host
              port:
                type: number
                title: Port
                maximum: 65535
                description: Destination port, default is 2055
              __template_host:
                type: string
                description: Binds 'host' to a variable for dynamic value resolution. Set to
                  variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                  (group-scoped). Variable value overrides 'host' at runtime.
              __template_port:
                type: string
                description: Binds 'port' to a variable for dynamic value resolution. Set to
                  variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                  (group-scoped). Variable value overrides 'port' at runtime.
        dnsResolvePeriodSec:
          type: number
          minimum: 0
          maximum: 86400
          title: DNS resolution period (sec)
          description: How often to resolve the destination hostname to an IP address.
            Ignored if all destinations are IP addresses. A value of 0 means
            every datagram sent will incur a DNS lookup.
        enableIpSpoofing:
          title: Enable Source IP spoofing
          description: Send NetFlow traffic using the original event's Source IP and port.
            To enable this, you must install the external `udp-sender` helper
            binary at `/usr/bin/udp-sender` on all Worker Nodes and grant it the
            `CAP_NET_RAW` capability.
          type: boolean
        description:
          type: string
          title: Description
        maxRecordSize:
          type: number
          title: Maximum transmission unit (MTU)
          minimum: 1
          description: MTU in bytes. The actual maximum NetFlow payload size will be MTU
            minus IP and UDP headers (28 bytes for IPv4, 48 bytes for IPv6). For
            example, with the default MTU of 1500, the max payload is 1472 bytes
            for IPv4. Payloads exceeding this limit will be dropped.
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
    OutputDynatraceHttp:
      type: object
      required:
        - type
        - format
        - endpoint
        - telemetryType
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - dynatrace_http
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        method:
          $ref: "#/components/schemas/MethodOptions"
        keepAlive:
          type: boolean
          title: Keep alive
          description: Disable to close the connection immediately after sending the
            outgoing request
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 5000
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
          maximum: 50000
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events. You can also add headers dynamically
            on a per-event basis in the __headers field, as explained in [Cribl
            Docs](https://docs.cribl.io/stream/destinations-webhook/#internal-fields).
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        authType:
          type: string
          title: Authentication type
          enum:
            - token
            - textSecret
          x-speakeasy-enum-descriptions:
            - Auth token
            - Token (text secret)
          x-speakeasy-unknown-values: allow
        format:
          type: string
          title: Format
          description: How to format events before sending. Defaults to JSON. Plaintext is
            not currently supported.
          enum:
            - json_array
            - plaintext
          x-speakeasy-enum-descriptions:
            - JSON
            - Plaintext
          x-speakeasy-unknown-values: allow
        endpoint:
          type: string
          title: Endpoint
          enum:
            - cloud
            - activeGate
            - manual
          x-speakeasy-enum-descriptions:
            - Cloud
            - ActiveGate
            - Manual
          x-speakeasy-unknown-values: allow
        telemetryType:
          type: string
          title: Telemetry type
          enum:
            - logs
            - metrics
          x-speakeasy-enum-descriptions:
            - Logs
            - Metrics
          x-speakeasy-unknown-values: allow
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        description:
          type: string
          title: Description
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        token:
          type: string
          title: Token
          description: Bearer token to include in the authorization header
        textSecret:
          type: string
          title: Token (text secret)
          description: Select or create a stored text secret
        environmentId:
          type: string
          title: Environment ID
          description: ID of the environment to send to
        activeGateDomain:
          type: string
          description: ActiveGate domain with Log analytics collector module enabled. For
            example
            https://{activeGate-domain}:9999/e/{environment-id}/api/v2/logs/ingest.
          title: ActiveGate domain
        url:
          title: URL
          type: string
          description: URL to send events to. Can be overwritten by an event's __url field.
          pattern: ^https?://.*
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
    OutputDynatraceOtlp:
      type: object
      required:
        - type
        - endpoint
        - endpointType
        - protocol
        - otlpVersion
        - tokenSecret
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - dynatrace_otlp
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        protocol:
          type: string
          title: Protocol
          description: Select a transport option for Dynatrace
          enum:
            - http
          x-speakeasy-enum-descriptions:
            - HTTP
          x-speakeasy-unknown-values: allow
        endpoint:
          type: string
          title: Endpoint
          description: The endpoint where Dynatrace events will be sent. Enter any valid
            URL or an IP address (IPv4 or IPv6; enclose IPv6 addresses in square
            brackets)
        otlpVersion:
          $ref: "#/components/schemas/OtlpVersionOptions131"
        compress:
          $ref: "#/components/schemas/CompressionOptionsDeflateGzip"
        httpCompress:
          $ref: "#/components/schemas/CompressionOptionsMessages"
        httpTracesEndpointOverride:
          type: string
          title: Traces endpoint override
          description: If you want to send traces to the default `{endpoint}/v1/traces`
            endpoint, leave this field empty; otherwise, specify the desired
            endpoint
        httpMetricsEndpointOverride:
          type: string
          title: Metrics endpoint override
          description: If you want to send metrics to the default `{endpoint}/v1/metrics`
            endpoint, leave this field empty; otherwise, specify the desired
            endpoint
        httpLogsEndpointOverride:
          type: string
          title: Logs endpoint override
          description: If you want to send logs to the default `{endpoint}/v1/logs`
            endpoint, leave this field empty; otherwise, specify the desired
            endpoint
        metadata:
          type: array
          title: Metadata
          description: List of key-value pairs to send with each gRPC request. Value
            supports JavaScript expressions that are evaluated just once, when
            the destination gets started. To pass credentials as metadata, use
            'C.Secret'.
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        dynamicHeadersEnabled:
          type: boolean
          title: Use dynamic metadata
          description: Batch event data upon dynamic metadata (whether presented or not)
        dynamicHeadersField:
          type: string
          title: Dynamic metadata field
          description: When presented, this field which contains metadata, will be
            injected into the Destination metadata and used to batch events.
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit
          description: Maximum size (in KB) of the request body. The maximum payload size
            is 4 MB. If this limit is exceeded, the entire OTLP message is
            dropped
          minimum: 1024
          maximum: 4096
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        connectionTimeout:
          type: number
          title: Connection timeout
          description: Amount of time (milliseconds) to wait for the connection to
            establish before retrying
        keepAliveTime:
          type: number
          title: Keep alive time (seconds)
          description: How often the sender should ping the peer to keep the connection open
          minimum: 1
        keepAlive:
          type: boolean
          title: Keep alive
          description: Disable to close the connection immediately after sending the
            outgoing request
        endpointType:
          type: string
          title: Endpoint type
          description: Select the type of Dynatrace endpoint configured
          enum:
            - saas
            - ag
          x-speakeasy-enum-descriptions:
            - SaaS
            - ActiveGate
          x-speakeasy-unknown-values: allow
        tokenSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        authTokenName:
          type: string
          title: Api-Token name
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
            For optimal performance, consider enabling this setting for non-load
            balanced destinations.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputSentinelOneAiSiem:
      type: object
      required:
        - type
        - region
        - endpoint
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - sentinel_one_ai_siem
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        region:
          type: string
          title: Region
          description: The SentinelOne region to send events to. In most cases you can
            find the region by either looking at your SentinelOne URL or knowing
            what geographic region your SentinelOne instance is contained in.
          enum:
            - US
            - CA
            - EMEA
            - AP
            - APS
            - AU
            - Custom
          x-speakeasy-unknown-values: allow
        endpoint:
          title: AI SIEM endpoint path
          type: string
          enum:
            - /services/collector/event
            - /services/collector/raw
          description: Endpoint to send events to. Use /services/collector/event for
            structured JSON payloads with standard HEC top-level fields. Use
            /services/collector/raw for unstructured log lines (plain text).
          x-speakeasy-unknown-values: allow
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1024
          maximum: 2097152
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthTokensItems"
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        description:
          type: string
          title: Description
        token:
          type: string
          title: AI SIEM API Key
          description: In the SentinelOne Console select Policy & Settings then select the
            Singularity AI SIEM section, API Keys will be at the bottom. Under
            Log Access Keys select a Write token and copy it here
        textSecret:
          type: string
          title: AI SIEM API Key (text secret)
          description: Select or create a stored text secret
        baseUrl:
          title: Base AI SIEM endpoint URL
          type: string
          pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]+)?$
          description: "Base URL of the endpoint used to send events to, such as
            https://<Your-S1-Tenant>.sentinelone.net. Must begin with http:// or
            https://, can include a port number, and no trailing slashes.
            Matches pattern: ^https?://[a-zA-Z0-9.-]+(:[0-9]+)?$."
        hostExpression:
          type: string
          title: serverHost expression
          description: Define serverHost for events using a JavaScript expression. You
            must enclose text constants in quotes (such as, 'myServer').
        sourceExpression:
          type: string
          title: logFile expression
          description: Define logFile for events using a JavaScript expression. You must
            enclose text constants in quotes (such as, 'myLogFile.txt').
        sourceTypeExpression:
          type: string
          title: parser expression
          description: Define the parser for events using a JavaScript expression. This
            value helps parse data into AI SIEM. You must enclose text constants
            in quotes (such as, 'dottedJson'). For custom parsers, substitute
            'dottedJson' with your parser's name.
        dataSourceCategoryExpression:
          type: string
          title: dataSource.category expression
          description: Define the dataSource.category for events using a JavaScript
            expression. This value helps categorize data and helps enable extra
            features in SentinelOne AI SIEM. You must enclose text constants in
            quotes. The default value is 'security'.
        dataSourceNameExpression:
          type: string
          title: dataSource.name expression
          description: Define the dataSource.name for events using a JavaScript
            expression. This value should reflect the type of data being
            inserted into AI SIEM. You must enclose text constants in quotes
            (such as, 'networkActivity' or 'authLogs').
        dataSourceVendorExpression:
          type: string
          title: dataSource.vendor expression
          description: Define the dataSource.vendor for events using a JavaScript
            expression. This value should reflect the vendor of the data being
            inserted into AI SIEM. You must enclose text constants in quotes
            (such as, 'Cisco' or 'Microsoft').
        eventTypeExpression:
          type: string
          title: event.type expression
          description: Optionally, define the event.type for events using a JavaScript
            expression. This value acts as a label, grouping events into
            meaningful categories. You must enclose text constants in quotes
            (such as, 'Process Creation' or 'Network Connection').
        host:
          type: string
          title: serverHost expression
          description: Define the serverHost for events using a JavaScript expression.
            This value will be passed to AI SIEM. You must enclose text
            constants in quotes (such as, 'myServerName').
        source:
          type: string
          title: logFile
          description: Specify the logFile value to pass as a parameter to SentinelOne AI
            SIEM. Don't quote this value. The default is cribl.
        sourceType:
          type: string
          title: parser
          description: Specify the sourcetype parameter for SentinelOne AI SIEM, which
            determines the parser. Don't quote this value. For custom parsers,
            substitute hecRawParser with your parser's name. The default is
            hecRawParser.
        dataSourceCategory:
          type: string
          title: dataSource.category
          description: Specify the dataSource.category value to pass as a parameter to
            SentinelOne AI SIEM. This value helps categorize data and enables
            additional features. Don't quote this value. The default is
            security.
        dataSourceName:
          type: string
          title: dataSource.name
          description: Specify the dataSource.name value to pass as a parameter to AI
            SIEM. This value should reflect the type of data being inserted.
            Don't quote this value. The default is cribl.
        dataSourceVendor:
          type: string
          title: dataSource.vendor
          description: Specify the dataSource.vendorvalue to pass as a parameter to AI
            SIEM. This value should reflect the vendor of the data being
            inserted. Don't quote this value. The default is cribl.
        eventType:
          type: string
          title: event.type
          description: Specify the event.type value to pass as an optional parameter to AI
            SIEM. This value acts as a label, grouping events into meaningful
            categories like Process Creation, File Modification, or Network
            Connection. Don't quote this value. By default, this field is empty.
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
    OutputChronicle:
      type: object
      required:
        - type
        - gcpProjectId
        - gcpInstance
        - region
        - logType
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - chronicle
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        apiVersion:
          type: string
          title: API version
        authenticationMethod:
          type: string
          title: Authentication method
          enum:
            - serviceAccount
            - serviceAccountSecret
          x-speakeasy-unknown-values: allow
        responseRetrySettings:
          type: array
          title: Settings for failed HTTP requests
          description: Automatically retry after unsuccessful response status codes, such
            as 429 (Too Many Requests) or 503 (Service Unavailable)
          minItems: 0
          items:
            $ref: "#/components/schemas/ResponseRetrySettingConfOutputWebhook"
        timeoutRetrySettings:
          $ref: "#/components/schemas/TimeoutRetrySettingsType"
        responseHonorRetryAfterHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) no
            longer than 180 seconds after the retry request. @{product} limits
            the delay to 180 seconds, even if the Retry-After header specifies a
            longer delay. When enabled, takes precedence over user-configured
            retry options. When disabled, all Retry-After headers are ignored.
        region:
          type: string
          title: Region
          description: Regional endpoint to send events to
        concurrency:
          type: number
          title: Request concurrency
          description: Maximum number of ongoing requests before blocking
          minimum: 1
          maximum: 32
        maxPayloadSizeKB:
          type: number
          title: Body size limit (KB)
          description: Maximum size, in KB, of the request body
          minimum: 1
          maximum: 4096
        maxPayloadEvents:
          type: number
          title: Events-per-request limit
          description: Maximum number of events to include in the request body. Default is
            0 (unlimited).
          minimum: 0
        compress:
          type: boolean
          title: Compress
          description: Compress the payload body before sending
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's). 
                    Enabled by default. When this setting is also present in TLS Settings (Client Side), 
                    that value will take precedence.
        timeoutSec:
          type: number
          minimum: 1
          maximum: 9007199254740991
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Body size limit.
        extraHttpHeaders:
          type: array
          title: Extra HTTP headers
          description: Headers to add to all events
          items:
            $ref: "#/components/schemas/ExtraHttpHeaderConfInputElastic"
        failedRequestLoggingMode:
          $ref: "#/components/schemas/FailedRequestLoggingModeOptions"
        safeHeaders:
          type: array
          title: Safe headers
          description: List of headers that are safe to log in plain text
          items:
            type: string
        useRoundRobinDns:
          type: boolean
          title: Round-robin DNS
          description: Enable round-robin DNS lookup. When a DNS server returns multiple
            addresses, @{product} will cycle through them in the order returned.
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        totalMemoryLimitKB:
          type: number
          title: Buffer memory limit (KB)
          description: Maximum total size of the batches waiting to be sent. If left
            blank, defaults to 5 times the max body size (if set). If 0, no
            limit is enforced.
          minimum: 0
        ingestionMethod:
          type: string
          title: Chronicle API ingestion method
        namespace:
          type: string
          title: Namespace
          description: User-configured environment namespace to identify the data domain
            the logs originated from. This namespace is used as a tag to
            identify the appropriate data domain for indexing and enrichment
            functionality. Can be overwritten by event field __namespace.
        logType:
          type: string
          title: Default log type
          description: Default log type value to send to SecOps. Can be overwritten by
            event field __logType.
        logTextField:
          type: string
          title: Log text field
          description: Name of the event field that contains the log text to send. If not
            specified, Stream sends a JSON representation of the whole event.
        gcpProjectId:
          type: string
          title: GCP project ID
          description: The Google Cloud Platform (GCP) project ID to send events to
        gcpInstance:
          type: string
          title: GCP instance
          description: The Google Cloud Platform (GCP) instance to send events to. This is
            the Chronicle customer uuid.
        customLabels:
          type: array
          title: Custom labels
          description: Custom labels to be added to every event
          items:
            type: object
            required:
              - key
              - value
            properties:
              key:
                type: string
                title: Key
              value:
                type: string
                title: Value
              rbacEnabled:
                type: boolean
                title: Enable RBAC
                description: Designate this label for role-based access control and filtering
        endpoint:
          type: string
          title: Endpoint
          description: "Chronicle API service endpoint. If empty, defaults to the
            Region-specific endpoint. Otherwise, it must point to a Chronicle
            API-compatible endpoint. (Example:
            https://custom-endpoint.googleapis.com)"
          pattern: ^https?://.*
        description:
          type: string
          title: Description
        serviceAccountCredentials:
          type: string
          title: Service account credentials
          description: Contents of service account credentials (JSON keys) file downloaded
            from Google Cloud. To upload a file, click the upload button at this
            field's upper right.
        serviceAccountCredentialsSecret:
          type: string
          title: Service account credentials (text secret)
          description: Select or create a stored text secret
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_failedRequestLoggingMode:
          type: string
          description: Binds 'failedRequestLoggingMode' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'failedRequestLoggingMode' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_namespace:
          type: string
          description: Binds 'namespace' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'namespace' at runtime.
        __template_logType:
          type: string
          description: Binds 'logType' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'logType' at runtime.
        __template_logTextField:
          type: string
          description: Binds 'logTextField' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'logTextField' at runtime.
        __template_gcpProjectId:
          type: string
          description: Binds 'gcpProjectId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'gcpProjectId' at runtime.
        __template_gcpInstance:
          type: string
          description: Binds 'gcpInstance' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'gcpInstance' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
    OutputDatabricks:
      type: object
      required:
        - type
        - workspaceId
        - scope
        - clientId
        - clientTextSecret
        - catalog
        - schema
        - eventsVolumeName
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - databricks
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        destPath:
          type: string
          title: Upload path
          description: Optional path to prepend to files before uploading.
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files before compressing and
            moving to final destination. Use performant, stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 1800
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 1800
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        workspaceId:
          type: string
          title: Workspace ID
          description: Unique identifier for the Databricks workspace. Used to construct
            the OAuth login URL and API base URL.
        workspaceHost:
          type: string
          title: Workspace host
          description: Hostname for the Databricks workspace. Override this to connect to
            government or secure cloud environments (e.g. cloud.databricks.us,
            cloud.databricks.mil, azuredatabricks.net).
        scope:
          type: string
          title: OAuth scope
          description: OAuth scope for Unity Catalog authentication
        clientId:
          type: string
          title: Client ID
          description: OAuth client ID for Unity Catalog authentication
        catalog:
          type: string
          title: Catalog
          description: Name of the Unity Catalog catalog to use for the Destination.
        schema:
          type: string
          title: Schema
          description: Name of the Unity Catalog schema to use for the Destination.
        eventsVolumeName:
          type: string
          title: Events volume name
          description: Name of the Unity Catalog volume where event data is written.
        clientTextSecret:
          type: string
          title: Client Secret
          description: OAuth client secret for Unity Catalog authentication
        timeoutSec:
          type: integer
          title: Request timeout
          description: Amount of time, in seconds, to wait for a request to complete
            before canceling it.
          minimum: 30
        description:
          type: string
          title: Description
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputMicrosoftFabric:
      type: object
      required:
        - type
        - bootstrap_server
        - topic
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - microsoft_fabric
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        topic:
          type: string
          title: Topic name
          description: Topic name from Fabric Eventstream's endpoint
        ack:
          $ref: "#/components/schemas/AcknowledgmentsOptions"
        format:
          $ref: "#/components/schemas/RecordDataFormatOptions"
        maxRecordSizeKB:
          type: number
          minimum: 1
          title: Record size limit (KB, uncompressed)
          description: Maximum size of each record batch before compression. Setting
            should be < message.max.bytes settings in Event Hubs brokers.
        flushEventCount:
          type: number
          minimum: 1
          maximum: 10000
          title: Events-per-batch limit
          description: Maximum number of events in a batch before forcing a flush
        flushPeriodSec:
          type: number
          title: Flush period (sec)
          description: Maximum time between requests. Small values could cause the payload
            size to be smaller than the configured Max record size.
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a connection to complete successfully
          minimum: 1000
          maximum: 3600000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for Kafka to respond to a request
          minimum: 1000
          maximum: 3600000
        maxRetries:
          type: number
          title: Retry limit
          description: If messages are failing, you can set the maximum number of retries
            as high as 100 to prevent loss of data
          minimum: 0
          maximum: 100
        maxBackOff:
          type: number
          title: Backoff limit (ms)
          description: The maximum wait time for a retry, in milliseconds. Default (and
            minimum) is 30,000 ms (30 seconds); maximum is 180,000 ms (180
            seconds).
          minimum: 30000
          maximum: 180000
        initialBackoff:
          type: number
          title: Initial retry interval (ms)
          description: Initial value used to calculate the retry, in milliseconds. Maximum
            is 600,000 ms (10 minutes).
          minimum: 300
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Set the backoff multiplier (2-20) to control the retry frequency
            for failed messages. For faster retries, use a lower multiplier. For
            slower retries with more delay between attempts, use a higher
            multiplier. The multiplier is used in an exponential backoff
            formula; see the Kafka
            [documentation](https://kafka.js.org/docs/retry-detailed) for
            details.
          minimum: 2
          maximum: 20
        authenticationTimeout:
          type: number
          title: Authentication timeout (ms)
          description: Maximum time to wait for Kafka to respond to an authentication
            request
          minimum: 1000
          maximum: 3600000
        reauthenticationThreshold:
          type: number
          title: Reauthentication threshold (ms)
          description: Specifies a time window during which @{product} can reauthenticate
            if needed. Creates the window measuring backward from the moment
            when credentials are set to expire.
          minimum: 1000
          maximum: 1800000
        sasl:
          type: object
          title: Authentication
          description: Authentication parameters to use when connecting to bootstrap
            server. Using TLS is highly recommended.
          required:
            - disabled
          properties:
            disabled:
              type: boolean
              title: Disabled
            mechanism:
              $ref: "#/components/schemas/SaslMechanismOptionsSaslOauthbearerPlain"
            username:
              type: string
              title: SASL JASS username
              description: The username for authentication. This should always be
                $ConnectionString.
            textSecret:
              type: string
              title: SASL JASS password
              description: Select or create a stored text secret corresponding to the SASL
                JASS Password Primary or Password Secondary
            clientSecretAuthType:
              $ref: "#/components/schemas/AuthenticationMethodOptionsAuth"
            clientTextSecret:
              type: string
              title: Client secret (text secret)
              description: Select or create a stored text secret
            certificateName:
              type: string
              title: Certificate
              description: Select or create a stored certificate
            certPath:
              type: string
            privKeyPath:
              type: string
            passphrase:
              type: string
            oauthEndpoint:
              $ref: "#/components/schemas/MicrosoftEntraIdAuthenticationEndpointOptionsSasl"
            clientId:
              type: string
              title: Client ID
              description: client_id to pass in the OAuth request parameter
            tenantId:
              type: string
              title: Tenant identifier
              description: Directory ID (tenant identifier) in Azure Active Directory
            scope:
              type: string
              title: Scope
              description: Scope to pass in the OAuth request parameter
            __template_mechanism:
              type: string
              description: Binds 'mechanism' to a variable for dynamic value resolution. Set
                to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'mechanism' at runtime.
            __template_oauthEndpoint:
              type: string
              description: Binds 'oauthEndpoint' to a variable for dynamic value resolution.
                Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'oauthEndpoint' at
                runtime.
            __template_clientId:
              type: string
              description: Binds 'clientId' to a variable for dynamic value resolution. Set to
                variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'clientId' at runtime.
            __template_tenantId:
              type: string
              description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
                variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'tenantId' at runtime.
            __template_scope:
              type: string
              description: Binds 'scope' to a variable for dynamic value resolution. Set to
                variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'scope' at runtime.
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideType"
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptions"
        bootstrap_server:
          type: string
          title: Bootstrap server
          description: Bootstrap server from Fabric Eventstream's endpoint
        description:
          type: string
          title: Description
        pqStrictOrdering:
          title: Strict ordering
          description: Use FIFO (first in, first out) processing. Disable to forward new
            events to receivers before queue is flushed.
          type: boolean
        pqRatePerSec:
          type: number
          title: Drain rate limit (EPS)
          description: Throttling rate (in events per second) to impose while writing to
            Destinations from PQ. Defaults to 0, which disables throttling.
          minimum: 0
        pqMode:
          $ref: "#/components/schemas/ModeOptions"
        pqMaxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use pqMaxBufferSizeBytes instead.
          minimum: 42
          maximum: 1000
        pqMaxBackpressureSec:
          type: number
          title: Backpressure duration limit
          description: How long (in seconds) to wait for backpressure to resolve before
            engaging the queue
          minimum: 0
        pqMaxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing (KB, MB, etc.)
          pattern: ^\d+\s*(?:\w{2})?$
        pqMaxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        pqPath:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/<output-id>."
        pqCompress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqOnBackpressure:
          $ref: "#/components/schemas/QueueFullBehaviorOptions"
        pqMaxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        pqControls:
          type: object
          title: ""
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_topic:
          type: string
          description: Binds 'topic' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'topic' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_bootstrap_server:
          type: string
          description: Binds 'bootstrap_server' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'bootstrap_server' at runtime.
    OutputCloudflareR2:
      type: object
      required:
        - type
        - bucket
        - stagePath
        - endpoint
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - cloudflare_r2
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        awsAuthenticationMethod:
          type: string
          title: Authentication method
          description: AWS authentication method. Choose Auto to use IAM roles.
          enum:
            - auto
            - secret
          x-speakeasy-enum-descriptions:
            - Auto
            - Secret Key pair
          x-speakeasy-unknown-values: allow
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: R2 bucket name
          description: "Name of the destination R2 bucket. This value can be a constant or
            a JavaScript expression that can only be evaluated at init time.
            Example referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        awsSecretKey:
          type: string
          title: Secret key
          description: "Secret key. This value can be a constant or a JavaScript
            expression. Example: `${C.env.SOME_SECRET}`)"
        endpoint:
          type: string
          title: R2 endpoint
          description: "Cloudflare R2 service URL (example:
            https://<ACCOUNT_ID>.r2.cloudflarestorage.com)"
          pattern: ^https?://.*
        storageClass:
          $ref: "#/components/schemas/StorageClassOptionsReducedredundancyStandard"
        serverSideEncryption:
          $ref: "#/components/schemas/ServerSideEncryptionForUploadedObjectsOptionsAes256"
        description:
          type: string
          title: Description
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_awsSecretKey:
          type: string
          description: Binds 'awsSecretKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'awsSecretKey' at runtime.
        __template_storageClass:
          type: string
          description: Binds 'storageClass' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'storageClass' at runtime.
        __template_serverSideEncryption:
          type: string
          description: Binds 'serverSideEncryption' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'serverSideEncryption' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputNutanixObjects:
      type: object
      required:
        - type
        - bucket
        - stagePath
        - endpoint
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - nutanix_objects
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSecret"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: Nutanix Objects bucket name
          description: "Name of the destination Nutanix Objects bucket. Must be a
            JavaScript expression (which can evaluate to a constant value),
            enclosed in quotes or backticks. Can be evaluated only at
            initialization time. Example referencing a Global Variable:
            `myBucket-${C.vars.myVar}`"
        region:
          type: string
          title: Region
          description: Region where the Nutanix Objects bucket is located
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        endpoint:
          type: string
          title: Nutanix Objects endpoint
          description: "Nutanix Objects S3-compatible endpoint URL (example:
            https://objects.nutanix.local)"
          pattern: ^https?://.*
        description:
          type: string
          title: Description
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputStorjS3:
      type: object
      required:
        - type
        - bucket
        - stagePath
        - endpoint
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - storj_s3
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSecret"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: Storj bucket name
          description: "Name of the destination Storj bucket. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at initialization time.
            Example referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        endpoint:
          type: string
          title: Storj endpoint
          description: "Storj S3-compatible gateway endpoint URL (example:
            https://gateway.storjshare.io)"
          pattern: ^https?://.*
        description:
          type: string
          title: Description
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputAlphasocS3:
      type: object
      required:
        - type
        - bucket
        - stagePath
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - alphasoc_s3
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSecret"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: AlphaSOC bucket name
          description: "Name of the destination AlphaSOC bucket. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at initialization time.
            Example referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        endpoint:
          type: string
          title: AlphaSOC endpoint
          description: "AlphaSOC S3-compatible endpoint URL (example:
            https://s3.alphasoc.net)"
          pattern: ^https?://.*
        description:
          type: string
          title: Description
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputDellS3:
      type: object
      required:
        - type
        - bucket
        - stagePath
        - endpoint
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - dell_s3
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSecret"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: Dell PowerScale OneFS bucket name
          description: "Name of the destination Dell PowerScale OneFS bucket. Must be a
            JavaScript expression (which can evaluate to a constant value),
            enclosed in quotes or backticks. Can be evaluated only at
            initialization time. Example referencing a Global Variable:
            `myBucket-${C.vars.myVar}`"
        region:
          type: string
          title: Region
          description: Region where the Dell PowerScale OneFS bucket is located
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        objectACL:
          $ref: "#/components/schemas/ObjectAclOptions"
        endpoint:
          type: string
          title: Dell PowerScale OneFS endpoint
          description: "Dell PowerScale OneFS S3-compatible endpoint URL (example:
            https://powerscale.example.com:9021)"
          pattern: ^https?://.*
        description:
          type: string
          title: Description
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_objectACL:
          type: string
          description: Binds 'objectACL' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'objectACL' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputCloudianS3:
      type: object
      required:
        - type
        - bucket
        - stagePath
        - endpoint
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - cloudian_s3
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        endpoint:
          type: string
          title: Cloudian HyperStore endpoint
          description: "Cloudian HyperStore S3-compatible endpoint URL (example:
            https://s3.hyperstore.example.com)"
          pattern: ^https?://.*
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSecret"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: Cloudian bucket name
          description: "Name of the destination Cloudian bucket. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at initialization time.
            Example referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        region:
          type: string
          title: Region
          description: Region where the Cloudian bucket is located
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        objectACL:
          $ref: "#/components/schemas/ObjectAclOptions"
        storageClass:
          $ref: "#/components/schemas/StorageClassOptions"
        serverSideEncryption:
          $ref: "#/components/schemas/ServerSideEncryptionForUploadedObjectsOptions"
        kmsKeyId:
          type: string
          title: KMS key ID
          description: ID or ARN of the KMS customer-managed key to use for encryption
        description:
          type: string
          title: Description
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_objectACL:
          type: string
          description: Binds 'objectACL' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'objectACL' at runtime.
        __template_storageClass:
          type: string
          description: Binds 'storageClass' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'storageClass' at runtime.
        __template_serverSideEncryption:
          type: string
          description: Binds 'serverSideEncryption' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'serverSideEncryption' at runtime.
        __template_kmsKeyId:
          type: string
          description: Binds 'kmsKeyId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'kmsKeyId' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputScalityS3:
      type: object
      required:
        - type
        - bucket
        - stagePath
        - endpoint
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - scality_s3
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSecret"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: Scality bucket name
          description: "Name of the destination Scality bucket. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at initialization time.
            Example referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        region:
          type: string
          title: Region
          description: Region where the Scality bucket is located
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        endpoint:
          type: string
          title: Scality endpoint
          description: "Scality RING S3-compatible endpoint URL (example:
            https://s3.scality.example.com)"
          pattern: ^https?://.*
        description:
          type: string
          title: Description
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_region:
          type: string
          description: Binds 'region' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'region' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    OutputAlibabaCloudS3:
      type: object
      required:
        - type
        - bucket
        - stagePath
        - endpoint
      properties:
        id:
          type: string
          title: Output ID
          description: Unique ID for this output
        type:
          type: string
          enum:
            - alibaba_cloud_s3
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process data before sending out to this output
        systemFields:
          type: array
          title: System fields
          description: Fields to automatically add to events, such as cribl_pipe. Supports
            wildcards.
          items:
            type: string
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSecret"
        reuseConnections:
          type: boolean
          title: Reuse connections
          description: Reuse connections between requests, which can improve performance
        rejectUnauthorized:
          type: boolean
          title: Reject unauthorized certificates
          description: Reject certificates that cannot be verified against a valid CA,
            such as self-signed certificates
        bucket:
          type: string
          title: Alibaba OSS bucket name
          description: "Name of the destination Alibaba OSS bucket. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at initialization time.
            Example referencing a Global Variable: `myBucket-${C.vars.myVar}`"
        destPath:
          type: string
          title: Key prefix
          description: "Prefix to prepend to files before uploading. Must be a JavaScript
            expression (which can evaluate to a constant value), enclosed in
            quotes or backticks. Can be evaluated only at init time. Example
            referencing a Global Variable: `myKeyPrefix-${C.vars.myVar}`"
        maxConcurrentFileParts:
          type: number
          title: Concurrent file parts upload limit
          description: Maximum number of parts to upload in parallel per file. Minimum
            part size is 5MB.
          minimum: 1
          maximum: 10
        verifyPermissions:
          type: boolean
          title: Verify if bucket exists
          description: Disable if you can access files within the bucket but not the
            bucket itself
        maxClosingFilesToBackpressure:
          type: number
          title: Staging file limit
          description: Maximum number of files that can be waiting for upload before
            backpressure is applied
          minimum: 10
          maximum: 4200
        stagePath:
          type: string
          title: Staging location
          description: Filesystem location in which to buffer files, before compressing
            and moving to final destination. Use performant and stable storage.
        addIdToStagePath:
          type: boolean
          title: Add output ID
          description: Add the Output ID value to staging location
        removeEmptyDirs:
          type: boolean
          title: Remove empty staging directories
          description: Remove empty staging directories after moving files
        partitionExpr:
          type: string
          title: Partitioning expression
          description: JavaScript expression defining how files are partitioned and
            organized. Default is date-based. If blank, Stream will fall back to
            the event's __partition field value – if present – otherwise to each
            location's root directory.
        format:
          $ref: "#/components/schemas/DataFormatOptions"
        baseFileName:
          type: string
          title: File name prefix expression
          description: JavaScript expression to define the output filename prefix (can be
            constant)
        fileNameSuffix:
          type: string
          title: File name suffix expression
          description: JavaScript expression to define the output filename suffix (can be
            constant).  The `__format` variable refers to the value of the `Data
            format` field (`json` or `raw`).  The `__compression` field refers
            to the kind of compression being used (`none` or `gzip`).
        maxFileSizeMB:
          type: number
          title: File size limit (MB)
          description: Maximum uncompressed output file size. Files of this size will be
            closed and moved to final output location.
          maximum: 1024
          minimum: 5
        maxFileOpenTimeSec:
          type: number
          title: File open time limit (sec)
          description: Maximum amount of time to write to a file. Files open for longer
            than this will be closed and moved to final output location.
          minimum: 10
          maximum: 86400
        maxFileIdleTimeSec:
          type: number
          title: Idle time limit (sec)
          description: Maximum amount of time to keep inactive files open. Files open for
            longer than this will be closed and moved to final output location.
          minimum: 5
          maximum: 86400
        maxOpenFiles:
          type: number
          title: Open file limit
          description: Maximum number of files to keep open concurrently. When exceeded,
            @{product} will close the oldest open files and move them to the
            final output location.
          minimum: 10
          maximum: 2000
        headerLine:
          type: string
          title: Header line
          description: If set, this line will be written to the beginning of each output
            file
        writeHighWaterMark:
          type: number
          title: Writing high watermark (KB)
          description: Buffer size used to write to a file
          maximum: 4096
          minimum: 16
        onBackpressure:
          $ref: "#/components/schemas/BackpressureBehaviorOptionsBlockDrop"
        deadletterEnabled:
          type: boolean
          title: Enable dead-lettering
          description: If a file fails to move to its final destination after the maximum
            number of retries, move it to a designated directory to prevent
            further errors
        onDiskFullBackpressure:
          $ref: "#/components/schemas/DiskSpaceProtectionOptions"
        forceCloseOnShutdown:
          type: boolean
          title: Force close on shutdown
          description: Force all staged files to close during an orderly Node shutdown.
            This triggers immediate upload of in-progress data — regardless of
            idle time, file age, or size thresholds — to minimize data loss.
        retrySettings:
          $ref: "#/components/schemas/RetrySettingsType"
        orphans:
          $ref: "#/components/schemas/OrphanFileRecoveryType"
        objectACL:
          $ref: "#/components/schemas/ObjectAclOptions"
        endpoint:
          type: string
          title: OSS endpoint
          description: "Alibaba OSS S3-compatible endpoint URL. Examples: public
            `https://s3.oss-{region}.aliyuncs.com`, internal
            `https://s3.oss-{region}-internal.aliyuncs.com`"
          pattern: ^https?://.*
        description:
          type: string
          title: Description
        awsSecret:
          type: string
          title: Secret key pair
          description: Select or create a stored secret that references your access key
            and secret key
        compress:
          $ref: "#/components/schemas/CompressionOptionsHttp"
        compressionLevel:
          $ref: "#/components/schemas/CompressionLevelOptions"
        automaticSchema:
          type: boolean
          title: Automatic schema
          description: Automatically calculate the schema based on the events of each
            Parquet file generated
        parquetSchema:
          type: string
          title: Parquet schema
          description: To add a new schema, navigate to Processing > Knowledge > Parquet
            Schemas
          minLength: 1
        parquetVersion:
          $ref: "#/components/schemas/ParquetVersionOptions"
        parquetDataPageVersion:
          $ref: "#/components/schemas/DataPageVersionOptions"
        parquetRowGroupLength:
          type: number
          title: Group row limit
          description: The number of rows that every group will contain. The final group
            can contain a smaller number of rows.
          minimum: 1
          maximum: 67108864
        parquetPageSize:
          type: string
          title: Page size
          description: Target memory size for page segments, such as 1MB or 128MB.
            Generally, lower values improve reading speed, while higher values
            improve compression.
          pattern: ^\d+\s*(?:[kK][bB]|[mM][bB]|[gG][bB]|[tT][bB])?$
        shouldLogInvalidRows:
          type: boolean
          title: Log invalid rows
          description: Log up to 3 rows that @{product} skips due to data mismatch
        keyValueMetadata:
          type: array
          title: Metadata (optional)
          description: 'The metadata of files the Destination writes will include the
            properties you add here as key-value pairs. Useful for tagging.
            Examples: "key":"OCSF Event Class", "value":"9001"'
          minItems: 0
          items:
            $ref: "#/components/schemas/KeyValueMetadataConfOutputFilesystem"
        enableStatistics:
          type: boolean
          title: Write statistics
          description: Statistics profile an entire file in terms of minimum/maximum
            values within data, numbers of nulls, etc. You can use Parquet tools
            to view statistics.
        enableWritePageIndex:
          type: boolean
          title: Write page indexes
          description: One page index contains statistics for one data page. Parquet
            readers use statistics to enable page skipping.
        enablePageChecksum:
          type: boolean
          title: Write page checksum
          description: Parquet tools can use the checksum of a Parquet page to verify data
            integrity
        emptyDirCleanupSec:
          type: number
          title: Staging cleanup period
          description: How frequently, in seconds, to clean up empty directories
          minimum: 10
          maximum: 86400
        directoryBatchSize:
          type: number
          title: Directory batch size
          description: Number of directories to process in each batch during cleanup of
            empty directories. Minimum is 10, maximum is 10000. Higher values
            may require more memory.
        deadletterPath:
          type: string
          title: Dead-letter location
          description: Storage location for files that fail to reach their final
            destination after maximum retries are exceeded
        maxRetryNum:
          type: number
          title: Retry limit
          description: The maximum number of times a file will attempt to move to its
            final destination before being dead-lettered
          minimum: 1
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
        __template_bucket:
          type: string
          description: Binds 'bucket' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'bucket' at runtime.
        __template_destPath:
          type: string
          description: Binds 'destPath' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'destPath' at runtime.
        __template_partitionExpr:
          type: string
          description: Binds 'partitionExpr' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'partitionExpr' at runtime.
        __template_format:
          type: string
          description: Binds 'format' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'format' at runtime.
        __template_baseFileName:
          type: string
          description: Binds 'baseFileName' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'baseFileName' at runtime.
        __template_fileNameSuffix:
          type: string
          description: Binds 'fileNameSuffix' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'fileNameSuffix' at
            runtime.
        __template_onBackpressure:
          type: string
          description: Binds 'onBackpressure' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'onBackpressure' at
            runtime.
        __template_objectACL:
          type: string
          description: Binds 'objectACL' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'objectACL' at runtime.
        __template_endpoint:
          type: string
          description: Binds 'endpoint' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'endpoint' at runtime.
        __template_compress:
          type: string
          description: Binds 'compress' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'compress' at runtime.
        __template_parquetSchema:
          type: string
          description: Binds 'parquetSchema' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'parquetSchema' at runtime.
    Output:
      oneOf:
        - $ref: "#/components/schemas/OutputDefault"
        - $ref: "#/components/schemas/OutputWebhook"
        - $ref: "#/components/schemas/OutputSentinel"
        - $ref: "#/components/schemas/OutputDevnull"
        - $ref: "#/components/schemas/OutputSyslog"
        - $ref: "#/components/schemas/OutputSplunk"
        - $ref: "#/components/schemas/OutputSplunkLb"
        - $ref: "#/components/schemas/OutputSplunkHec"
        - $ref: "#/components/schemas/OutputWizHec"
        - $ref: "#/components/schemas/OutputTcpjson"
        - $ref: "#/components/schemas/OutputWavefront"
        - $ref: "#/components/schemas/OutputSignalfx"
        - $ref: "#/components/schemas/OutputFilesystem"
        - $ref: "#/components/schemas/OutputS3"
        - $ref: "#/components/schemas/OutputAzureBlob"
        - $ref: "#/components/schemas/OutputAzureDataExplorer"
        - $ref: "#/components/schemas/OutputAzureLogs"
        - $ref: "#/components/schemas/OutputKinesis"
        - $ref: "#/components/schemas/OutputHoneycomb"
        - $ref: "#/components/schemas/OutputAzureEventhub"
        - $ref: "#/components/schemas/OutputGoogleChronicle"
        - $ref: "#/components/schemas/OutputGoogleCloudStorage"
        - $ref: "#/components/schemas/OutputGoogleCloudLogging"
        - $ref: "#/components/schemas/OutputGoogleCloudObservability"
        - $ref: "#/components/schemas/OutputGooglePubsub"
        - $ref: "#/components/schemas/OutputExabeam"
        - $ref: "#/components/schemas/OutputKafka"
        - $ref: "#/components/schemas/OutputConfluentCloud"
        - $ref: "#/components/schemas/OutputMsk"
        - $ref: "#/components/schemas/OutputElastic"
        - $ref: "#/components/schemas/OutputElasticCloud"
        - $ref: "#/components/schemas/OutputNewrelic"
        - $ref: "#/components/schemas/OutputNewrelicEvents"
        - $ref: "#/components/schemas/OutputInfluxdb"
        - $ref: "#/components/schemas/OutputCloudwatch"
        - $ref: "#/components/schemas/OutputMinio"
        - $ref: "#/components/schemas/OutputStatsd"
        - $ref: "#/components/schemas/OutputStatsdExt"
        - $ref: "#/components/schemas/OutputGraphite"
        - $ref: "#/components/schemas/OutputRouter"
        - $ref: "#/components/schemas/OutputSns"
        - $ref: "#/components/schemas/OutputSqs"
        - $ref: "#/components/schemas/OutputSnmp"
        - $ref: "#/components/schemas/OutputSumoLogic"
        - $ref: "#/components/schemas/OutputDatadog"
        - $ref: "#/components/schemas/OutputGrafanaCloud"
        - $ref: "#/components/schemas/OutputLoki"
        - $ref: "#/components/schemas/OutputPrometheus"
        - $ref: "#/components/schemas/OutputRing"
        - $ref: "#/components/schemas/OutputOpenTelemetry"
        - $ref: "#/components/schemas/OutputServiceNow"
        - $ref: "#/components/schemas/OutputDataset"
        - $ref: "#/components/schemas/OutputCriblTcp"
        - $ref: "#/components/schemas/OutputCriblHttp"
        - $ref: "#/components/schemas/OutputCriblSearchEngine"
        - $ref: "#/components/schemas/OutputHumioHec"
        - $ref: "#/components/schemas/OutputCrowdstrikeNextGenSiem"
        - $ref: "#/components/schemas/OutputDlS3"
        - $ref: "#/components/schemas/OutputSecurityLake"
        - $ref: "#/components/schemas/OutputCriblLake"
        - $ref: "#/components/schemas/OutputDiskSpool"
        - $ref: "#/components/schemas/OutputClickHouse"
        - $ref: "#/components/schemas/OutputLocalSearchStorage"
        - $ref: "#/components/schemas/OutputXsiam"
        - $ref: "#/components/schemas/OutputNetflow"
        - $ref: "#/components/schemas/OutputDynatraceHttp"
        - $ref: "#/components/schemas/OutputDynatraceOtlp"
        - $ref: "#/components/schemas/OutputSentinelOneAiSiem"
        - $ref: "#/components/schemas/OutputChronicle"
        - $ref: "#/components/schemas/OutputDatabricks"
        - $ref: "#/components/schemas/OutputMicrosoftFabric"
        - $ref: "#/components/schemas/OutputCloudflareR2"
        - $ref: "#/components/schemas/OutputNutanixObjects"
        - $ref: "#/components/schemas/OutputStorjS3"
        - $ref: "#/components/schemas/OutputAlphasocS3"
        - $ref: "#/components/schemas/OutputDellS3"
        - $ref: "#/components/schemas/OutputCloudianS3"
        - $ref: "#/components/schemas/OutputScalityS3"
        - $ref: "#/components/schemas/OutputAlibabaCloudS3"
      discriminator:
        propertyName: type
        mapping:
          default: "#/components/schemas/OutputDefault"
          webhook: "#/components/schemas/OutputWebhook"
          sentinel: "#/components/schemas/OutputSentinel"
          devnull: "#/components/schemas/OutputDevnull"
          syslog: "#/components/schemas/OutputSyslog"
          splunk: "#/components/schemas/OutputSplunk"
          splunk_lb: "#/components/schemas/OutputSplunkLb"
          splunk_hec: "#/components/schemas/OutputSplunkHec"
          wiz_hec: "#/components/schemas/OutputWizHec"
          tcpjson: "#/components/schemas/OutputTcpjson"
          wavefront: "#/components/schemas/OutputWavefront"
          signalfx: "#/components/schemas/OutputSignalfx"
          filesystem: "#/components/schemas/OutputFilesystem"
          s3: "#/components/schemas/OutputS3"
          azure_blob: "#/components/schemas/OutputAzureBlob"
          azure_data_explorer: "#/components/schemas/OutputAzureDataExplorer"
          azure_logs: "#/components/schemas/OutputAzureLogs"
          kinesis: "#/components/schemas/OutputKinesis"
          honeycomb: "#/components/schemas/OutputHoneycomb"
          azure_eventhub: "#/components/schemas/OutputAzureEventhub"
          google_chronicle: "#/components/schemas/OutputGoogleChronicle"
          google_cloud_storage: "#/components/schemas/OutputGoogleCloudStorage"
          google_cloud_logging: "#/components/schemas/OutputGoogleCloudLogging"
          google_cloud_observability: "#/components/schemas/OutputGoogleCloudObservability"
          google_pubsub: "#/components/schemas/OutputGooglePubsub"
          exabeam: "#/components/schemas/OutputExabeam"
          kafka: "#/components/schemas/OutputKafka"
          confluent_cloud: "#/components/schemas/OutputConfluentCloud"
          msk: "#/components/schemas/OutputMsk"
          elastic: "#/components/schemas/OutputElastic"
          elastic_cloud: "#/components/schemas/OutputElasticCloud"
          newrelic: "#/components/schemas/OutputNewrelic"
          newrelic_events: "#/components/schemas/OutputNewrelicEvents"
          influxdb: "#/components/schemas/OutputInfluxdb"
          cloudwatch: "#/components/schemas/OutputCloudwatch"
          minio: "#/components/schemas/OutputMinio"
          statsd: "#/components/schemas/OutputStatsd"
          statsd_ext: "#/components/schemas/OutputStatsdExt"
          graphite: "#/components/schemas/OutputGraphite"
          router: "#/components/schemas/OutputRouter"
          sns: "#/components/schemas/OutputSns"
          sqs: "#/components/schemas/OutputSqs"
          snmp: "#/components/schemas/OutputSnmp"
          sumo_logic: "#/components/schemas/OutputSumoLogic"
          datadog: "#/components/schemas/OutputDatadog"
          grafana_cloud: "#/components/schemas/OutputGrafanaCloud"
          loki: "#/components/schemas/OutputLoki"
          prometheus: "#/components/schemas/OutputPrometheus"
          ring: "#/components/schemas/OutputRing"
          open_telemetry: "#/components/schemas/OutputOpenTelemetry"
          service_now: "#/components/schemas/OutputServiceNow"
          dataset: "#/components/schemas/OutputDataset"
          cribl_tcp: "#/components/schemas/OutputCriblTcp"
          cribl_http: "#/components/schemas/OutputCriblHttp"
          cribl_search_engine: "#/components/schemas/OutputCriblSearchEngine"
          humio_hec: "#/components/schemas/OutputHumioHec"
          crowdstrike_next_gen_siem: "#/components/schemas/OutputCrowdstrikeNextGenSiem"
          dl_s3: "#/components/schemas/OutputDlS3"
          security_lake: "#/components/schemas/OutputSecurityLake"
          cribl_lake: "#/components/schemas/OutputCriblLake"
          disk_spool: "#/components/schemas/OutputDiskSpool"
          click_house: "#/components/schemas/OutputClickHouse"
          local_search_storage: "#/components/schemas/OutputLocalSearchStorage"
          xsiam: "#/components/schemas/OutputXsiam"
          netflow: "#/components/schemas/OutputNetflow"
          dynatrace_http: "#/components/schemas/OutputDynatraceHttp"
          dynatrace_otlp: "#/components/schemas/OutputDynatraceOtlp"
          sentinel_one_ai_siem: "#/components/schemas/OutputSentinelOneAiSiem"
          chronicle: "#/components/schemas/OutputChronicle"
          databricks: "#/components/schemas/OutputDatabricks"
          microsoft_fabric: "#/components/schemas/OutputMicrosoftFabric"
          cloudflare_r2: "#/components/schemas/OutputCloudflareR2"
          nutanix_objects: "#/components/schemas/OutputNutanixObjects"
          storj_s3: "#/components/schemas/OutputStorjS3"
          alphasoc_s3: "#/components/schemas/OutputAlphasocS3"
          dell_s3: "#/components/schemas/OutputDellS3"
          cloudian_s3: "#/components/schemas/OutputCloudianS3"
          scality_s3: "#/components/schemas/OutputScalityS3"
          alibaba_cloud_s3: "#/components/schemas/OutputAlibabaCloudS3"
    CountedOutput:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Output"
    CountedOutputResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/OutputResponse"
    OutputResponse:
      allOf:
        - $ref: "#/components/schemas/Output"
        - type: object
          properties:
            notifications:
              type: array
              items:
                $ref: "#/components/schemas/Notification"
              description: Notifications attached to the Destination.
            status:
              $ref: "#/components/schemas/StatusType"
      description: Destination configuration with optional Notifications and runtime status.
    DestinationType:
      type: string
      enum:
        - default
        - router
        - tcpjson
        - splunk
        - splunk_lb
        - splunk_hec
        - syslog
        - filesystem
        - s3
        - azure_blob
        - azure_data_explorer
        - sentinel
        - azure_logs
        - kafka
        - confluent_cloud
        - msk
        - kinesis
        - elastic
        - elastic_cloud
        - microsoft_fabric
        - cloudflare_r2
        - honeycomb
        - newrelic
        - newrelic_events
        - snmp
        - influxdb
        - minio
        - devnull
        - cloudwatch
        - azure_eventhub
        - statsd
        - statsd_ext
        - graphite
        - wavefront
        - signalfx
        - sqs
        - google_cloud_storage
        - sumo_logic
        - datadog
        - webhook
        - prometheus
        - google_pubsub
        - google_chronicle
        - chronicle
        - google_cloud_observability
        - grafana_cloud
        - loki
        - open_telemetry
        - service_now
        - dynatrace_otlp
        - sentinel_one_ai_siem
        - dataset
        - ring
        - humio_hec
        - crowdstrike_next_gen_siem
        - cribl_http
        - cribl_tcp
        - cribl_search_engine
        - google_cloud_logging
        - sns
        - dl_s3
        - security_lake
        - cribl_lake
        - exabeam
        - disk_spool
        - click_house
        - local_search_storage
        - xsiam
        - netflow
        - dynatrace_http
        - databricks
        - wiz_hec
        - nutanix_objects
        - storj_s3
        - alphasoc_s3
        - dell_s3
        - cloudian_s3
        - scality_s3
        - alibaba_cloud_s3
      x-speakeasy-unknown-values: allow
    CountedOutputSamplesResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/OutputSamplesResponse"
    OutputSamplesResponse:
      type: object
      properties:
        events:
          type: array
          items:
            type: object
            additionalProperties: true
          description: Array of sample events returned from a Destination test.
      required:
        - events
      description: Sample events from a Destination.
    CountedOutputTestResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/OutputTestResponse"
    OutputTestResponse:
      type: object
      properties:
        details:
          type: object
          additionalProperties: true
          description: Additional details about the Destination test, such as per-event
            results and transport-level information.
        error:
          type: string
          description: Error message that describes a failed Destination test.
        outputId:
          type: string
          description: The <code>id</code> of the Destination that was tested.
        success:
          type: boolean
          description: If <code>true</code>, the Destination test succeeded. Otherwise,
            <code>false</code>.
        successDetail:
          type: string
          description: Human-readable description for a successful Destination test result.
      required:
        - outputId
        - success
    OutputTestRequest:
      type: object
      properties:
        events:
          type: array
          items:
            type: object
            additionalProperties: true
          description: Array of event objects to send to the Destination for testing.
      required:
        - events
      description: Request body for testing a Destination by sending sample events.
    SchemaLibEntry:
      type: object
      additionalProperties: true
      required:
        - id
        - schema
      properties:
        id:
          type: string
          title: ID
          pattern: ^[a-zA-Z0-9_-]+$
        description:
          type: string
          title: Description
        schema:
          type: string
          title: Schema
          description: JSON schema matching standards of draft version 2019-09
    CountedSchemaLibEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SchemaLibEntry"
    CountedPipeline:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Pipeline"
    Pipeline:
      title: Pipeline Settings
      type: object
      required:
        - conf
        - id
      properties:
        id:
          title: ID
          type: string
        conf:
          type: object
          additionalProperties: false
          properties:
            asyncFuncTimeout:
              type: integer
              title: Async function timeout (ms)
              description: Time (in ms) to wait for an async function to complete processing
                of a data item
              minimum: 0
              maximum: 10000
            output:
              type: string
              title: Output event destination
              description: The output destination for events processed by this Pipeline
            description:
              title: Description
              type: string
            streamtags:
              type: array
              title: Tags
              description: Tags for filtering and grouping in @{product}
              items:
                type: string
            functions:
              title: Functions
              description: List of Functions to pass data through
              type: array
              items:
                $ref: "#/components/schemas/PipelineFunctionConf"
            groups:
              type: object
              additionalProperties:
                type: object
                required:
                  - name
                properties:
                  name:
                    type: string
                    title: Group name
                  description:
                    type: string
                    title: Description
                  disabled:
                    type: boolean
                    title: Disabled
            __template_streamtags:
              type: string
              description: Binds 'streamtags' to a variable for dynamic value resolution. Set
                to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
                (group-scoped). Variable value overrides 'streamtags' at
                runtime.
    CountedProfilerItem:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ProfilerItem"
    ProfilerItem:
      type: object
      properties:
        createTime:
          type: integer
          description: Timestamp (in Unix time) when the profile capture was created.
        id:
          type: string
          description: Filename of the CPU profile capture.
        profId:
          type: string
          description: Optional suffix embedded in the capture filename. Omit or send an
            empty string to let the server choose a value. When non-empty, only
            ASCII letters, digits, and underscores are allowed.
          pattern: ^[A-Za-z0-9_]*$
        size:
          type: integer
          description: Size of the profile file, in bytes.
        workerId:
          type: string
          description: Identifier for the Worker Process that generated the profile,
            extracted from the filename of the CPU profile capture.
      required:
        - id
    CountedRoutes:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Routes"
    RouteComment:
      type: object
      properties:
        comment:
          type: string
          description: Brief description of the Route.
        groupId:
          type: string
          description: Unique identifier for the Route Group that the Route is associated
            with.
        id:
          type: string
          description: Unique identifier for the comment.
        index:
          type: integer
          description: Relative position of the comment among all comments for the Route.
      required:
        - comment
        - id
        - index
    RouteCloneConf:
      type: object
      additionalProperties:
        type: string
      description: Key-value pairs to set or overwrite in the cloned event.
    TargetContext:
      type: string
      enum:
        - group
        - pack
      x-speakeasy-unknown-values: allow
    RouteConf:
      type: object
      properties:
        clones:
          type: array
          items:
            $ref: "#/components/schemas/RouteCloneConf"
          description: Array of clone configurations, each with a key-value pair to set or
            overwrite in cloned events. Original events continue to the next
            Route.
        context:
          type: string
          description: "Context for the Route: <code>group</code> (Worker Group or Edge
            Fleet) or <code>pack</code>."
        description:
          type: string
          description: Brief description of the Route.
        disabled:
          type: boolean
          description: If <code>true</code>, disable the Route. Otherwise,
            <code>false</code>.
        enableOutputExpression:
          type: boolean
          description: If <code>true</code>, use the <code>outputExpression</code> for
            dynamic Destination selection. Otherwise, <code>false</code>.
        filter:
          type: string
          description: JavaScript expression to select events for routing.
        final:
          type: boolean
          description: If <code>true</code> the Route processes matched events and sends
            them to the specified Pipeline. Matched events do not continue to
            the next Route, but non-matched events do continue to the next
            Route. If <code>false</code>, the Route processes matched events and
            sends them to the specified Pipeline, and all events (matched and
            non-matched) continue to the next Route. Must be <code>false</code>
            to clone events.
        groupId:
          type: string
          description: Unique identifier for the Route Group that the Route is associated
            with.
        id:
          type: string
          description: Unique identifier for the Route.
        name:
          type: string
          description: Name of the Route.
        output:
          type: string
          description: Destination that the Route sends matching events to after the
            Pipeline processes the events.
        outputExpression:
          type: string
          description: JavaScript expression to evaluate for dynamic Destination
            selection. Evaluation occurs when the Route is constructed, not for
            each event.
        pipeline:
          type: string
          description: Pipeline that the Route sends matching events to.
        targetContext:
          $ref: "#/components/schemas/TargetContext"
          description: "Target context for subsequent event processing after applying the
            Route: <code>group</code> (Worker Group or Edge Fleet) or
            <code>pack</code>."
      required:
        - final
        - id
        - name
        - pipeline
    Routes:
      type: object
      properties:
        comments:
          type: array
          items:
            $ref: "#/components/schemas/RouteComment"
          description: Array of user-provided comments that describe or annotate Routes.
        groups:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeRoutesGroups"
          description: Information about the Route Groups that the Route is associated with.
        id:
          type: string
          description: Unique identifier for the Routing table. The supported value is
            <code>default</code>.
        routes:
          type: array
          items:
            $ref: "#/components/schemas/RouteConf"
          description: Array of Route configurations that define how events are processed
            and routed.
      required:
        - id
        - routes
    RoutesInput:
      type: object
      properties:
        comments:
          type: array
          items:
            $ref: "#/components/schemas/RouteComment"
          description: Array of user-provided comments that describe or annotate Routes.
        groups:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeRoutesGroups"
          description: Information about the Route Groups that the Route is associated with.
        id:
          type: string
          description: Unique identifier for the Routing table. The supported value is
            <code>default</code>.
        routes:
          type: array
          items:
            $ref: "#/components/schemas/RouteConfInput"
          description: Array of Route configurations that define how events are processed
            and routed.
      required:
        - id
        - routes
    RouteDefinitions:
      type: array
      items:
        $ref: "#/components/schemas/RouteConfInput"
    CountedRestSecret:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/RestSecret"
    RestSecret:
      type: object
      properties:
        apiKey:
          type: string
          description: API key or access key. Required when <code>secretType</code> is
            <code>keypair</code>.
        description:
          type: string
          description: Brief description of the secret.
        folderId:
          type: string
          description: Folder ID for a shared global secret. Present only when the row
            originates from a global secret folder.
        id:
          type: string
          description: Unique identifier for the secret.
        password:
          type: string
          description: Password. Required when <code>secretType</code> is
            <code>credentials</code>.
        readOnly:
          type: boolean
          description: If <code>true</code>, the secret is read-only because it is defined
            in global scope.
        secretKey:
          type: string
          description: Secret key. Required when <code>secretType</code> is
            <code>keypair</code>.
        secretType:
          $ref: "#/components/schemas/SecretTypeOptionsRestSecret"
        tags:
          type: string
          description: Tags for categorizing or organizing the secret.
        username:
          type: string
          description: Username. Required when <code>secretType</code> is
            <code>credentials</code>.
        value:
          type: string
          description: Secret value. Required when <code>secretType</code> is
            <code>text</code>.
      required:
        - id
        - secretType
    SecretType:
      type: string
      enum:
        - text
        - keypair
        - credentials
      x-speakeasy-unknown-values: allow
    CountedReferencedEntity:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ReferencedEntity"
    ReferencedEntity:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the referenced entity.
        type:
          type: string
          description: Entity type.
          example: inputs
      required:
        - id
        - type
      description: Reference to another entity in the system.
    CountedInputStatus:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/InputStatus"
    HealthCountType:
      type: object
      properties:
        Green:
          type: number
        Yellow:
          type: number
        Red:
          type: number
        Unknown:
          type: number
    AggregatedPQStatus:
      type: object
      properties:
        error:
          $ref: "#/components/schemas/StatusError"
          description: Error information for the persistent queue, if applicable.
        health:
          $ref: "#/components/schemas/HealthStringType"
          description: Health status of the persistent queue.
        healthCounts:
          $ref: "#/components/schemas/HealthCountType"
          description: "Counts of persistent queue health statuses for the Source or
            Destination across all Worker Processes. Includes only statuses with
            non-zero counts.<br/> <br><code>Green</code> == Healthy: Normal
            operation<br/> <br><code>Yellow</code> == Degraded: Potential
            issues<br/> <br><code>Red</code> == Critical: Problem or error that
            affects operation<br/> <br><code>Unknown</code> == Unknown: Cannot
            determine health status."
        timestamp:
          type: number
          description: Timestamp (in Unix time) when the persistent queue status was last
            updated.
      required:
        - health
        - healthCounts
        - timestamp
    AggregatedInputOutputStatusBody:
      type: object
      properties:
        error:
          $ref: "#/components/schemas/StatusError"
          description: Error information, if applicable.
        health:
          $ref: "#/components/schemas/HealthStringType"
          description: Overall health status of the Source or Destination.
        healthCounts:
          $ref: "#/components/schemas/HealthCountType"
          description: "Counts of health statuses for the Source or Destination across all
            Worker Processes. Includes only statuses with non-zero counts.<br/>
            <br><code>Green</code> == Healthy: Normal operation<br/>
            <br><code>Yellow</code> == Degraded: Potential issues<br/>
            <br><code>Red</code> == Critical: Problem or error that affects
            operation<br/> <br><code>Unknown</code> == Unknown: Cannot determine
            health status."
        metrics:
          type: object
          additionalProperties: true
          description: Metrics data for the Source or Destination, including base metrics,
            aggregated across all Worker Processes. For load-balanced
            Destinations, includes item-level metrics.
        pq:
          $ref: "#/components/schemas/AggregatedPQStatus"
          description: Persistent queue status information (if persistent queue is enabled).
        timestamp:
          type: number
          description: Timestamp (in Unix time) when the status was last updated.
      required:
        - health
        - healthCounts
        - timestamp
    InputStatus:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the Source or Destination.
        status:
          $ref: "#/components/schemas/AggregatedInputOutputStatusBody"
          description: Status information for the Source or Destination, aggregated across
            all Worker Processes.
        type:
          type: string
          description: Type of the Source or Destination.
      required:
        - id
        - status
      description: Status of the Source, aggregated across all Worker Processes.
    CountedOutputStatus:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/OutputStatus"
    OutputStatus:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the Source or Destination.
        status:
          $ref: "#/components/schemas/AggregatedInputOutputStatusBody"
          description: Status information for the Source or Destination, aggregated across
            all Worker Processes.
        type:
          type: string
          description: Type of the Source or Destination.
      required:
        - id
        - status
      description: Status of a Destination, aggregated across all Worker Processes.
    TcpOutCompression:
      type:
        - string
        - "null"
      enum:
        - gzip
        - none
        - null
      x-speakeasy-unknown-values: allow
    ConfigBundles:
      type: object
      properties:
        remoteUrl:
          type: string
      required:
        - remoteUrl
    FailoverConfigs:
      type: object
      properties:
        missedHBLimit:
          type: number
        period:
          type: string
        volume:
          type: string
      required:
        - volume
    SocksProxyOpts:
      type: object
      properties:
        disabled:
          type: boolean
        host:
          type: string
        password:
          type: string
        port:
          type: number
        type:
          type: number
        userId:
          type: string
      required:
        - host
        - port
    ResiliencyType:
      type: string
      enum:
        - none
        - failover
      x-speakeasy-unknown-values: allow
    SecureVersion:
      type: string
      enum:
        - TLSv1.3
        - TLSv1.2
        - TLSv1.1
        - TLSv1
      x-speakeasy-unknown-values: allow
    OutpostConfigs:
      type: object
      properties:
        listener:
          type: object
          properties:
            authTokenRotated:
              type: boolean
              description: When <code>true</code>, merged settings prefer
                <code>authToken</code> from instance configuration over userinfo
                embedded in <code>CRIBL_DIST_MASTER_URL</code>. Set when the
                Leader rotates the node token via RESTProxy.
            compression:
              $ref: "#/components/schemas/TcpOutCompression"
            connectionTimeout:
              type: number
            disableSNIRouting:
              type: boolean
            host:
              type: string
            ipWhitelistRegex:
              type: string
            maxActiveCxn:
              type: number
            maxBufferBytes:
              type: number
            port:
              type: number
            protocol:
              type: string
            tls:
              $ref: "#/components/schemas/TlsTypeOutpostConfigsListener"
            writeTimeout:
              type: number
          required:
            - host
            - port
    CountedOutpostConfigs:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/OutpostConfigs"
    CountedPqOrphanManagementConfig:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/PQOrphanManagementConfig"
    PQOrphanManagementConfig:
      type: object
      properties:
        disabled:
          type: boolean
          description: If <code>true</code>, orphan detection, reassignment, and automatic
            unassignment are disabled for the Worker Group. Useful when Workers
            may be offline for long periods.
        orphanDetectionThreshold:
          type: number
          description: Duration (in minutes) that a Worker may be absent from the Leader
            active set before its leftover PQ directories on shared storage are
            treated as orphans that are eligible for reassignment. Minimum value
            is <code>2</code>.
          example: 20
        scanInterval:
          type: number
          description: Interval (in minutes) between scans of shared PQ storage for orphan
            Worker directories. Minimum value is <code>1</code>. Controls only
            how often a PQ storage scan runs; the Leader evaluates Worker
            connectivity every minute.
          example: 5
      required:
        - disabled
        - orphanDetectionThreshold
        - scanInterval
    CountedPqStorageConfig:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/PQStorageConfig"
    PQStorageConfigFs:
      type: object
      properties:
        type:
          type: string
          const: fs
          description: Storage type. Use <code>fs</code> for local filesystem storage.
      required:
        - type
      title: PQStorageConfigFs
    PQStorageConfigNfs:
      type: object
      properties:
        compression:
          type: boolean
          description: If <code>true</code>, enable compression for the persistent queue
            storage. Otherwise, <code>false</code> (default).
        maxBufferSizeBytes:
          type: string
          description: Maximum size of events to hold in memory before writing the events
            to the filesystem. Value is a numeral and unit such as KB or MB.
            Minimum value is <code>64KB</code> and maximum value is
            <code>10MB</code>.
          pattern: ^((\d*\.?\d+)((KB|MB|GB|TB|PB|EB|ZB|YB|kb|mb|gb|tb|pb|eb|zb|yb){1}))$
          example: 1MB
        maxFileSize:
          type: string
          description: Maximum size of each persistent queue file before closing and
            optionally compressing. Value is a numeral and unit such as KB or
            MB. For <code>s3</code> and <code>nfs</code> storage types, the
            value must not exceed 100MB (parsed as a byte-size string).
          pattern: ^((\d*\.?\d+)((KB|MB|GB|TB|PB|EB|ZB|YB|kb|mb|gb|tb|pb|eb|zb|yb){1}))$
          example: 10MB
        maxSize:
          type: string
          description: Maximum disk space that the persistent queue can consume (as an
            average per Worker Process) before queueing stops. Value is a
            numeral and unit such as KB or MB. For <code>s3</code> and
            <code>nfs</code> storage types, the value must not exceed 2000 times
            the effective <code>maxFileSize</code> (including defaults where
            <code>maxFileSize</code> is omitted), after both are parsed to
            bytes.
          pattern: ^((\d*\.?\d+)((KB|MB|GB|TB|PB|EB|ZB|YB|kb|mb|gb|tb|pb|eb|zb|yb){1}))$
          example: 1GB
        mountPoint:
          type: string
          description: The local mount path where the NFS share is mounted.
          minLength: 1
          example: ${CRIBL_WORKER_VOLUME}/worker
        type:
          type: string
          const: nfs
          description: Storage type. Use <code>nfs</code> for network-attached file system
            (NFS) storage.
      required:
        - mountPoint
        - type
      title: PQStorageConfigNfs
    PQStorageConfigS3:
      type: object
      properties:
        assumeRoleArn:
          type: string
          description: Role ARN for temporary credentials when
            <code>enableAssumeRole</code> is <code>true</code>.
          example: arn:aws:iam::123456789012:role/CriblPQRole
        assumeRoleExternalId:
          type: string
          description: External ID for assume-role when required by the trust policy.
          example: cribl-pq-external-id
        awsApiKey:
          type: string
          description: Access key when <code>awsAuthenticationMethod</code> is
            <code>manual</code>. Optional on AWS when using IAM roles.
          example: AKIAIOSFODNN7EXAMPLE
        awsAuthenticationMethod:
          type: string
          enum:
            - auto
            - manual
            - secret
          description: "Credential source: <code>auto</code> uses the default AWS provider
            chain (env vars, instance role). <code>manual</code> uses and .
            <code>secret</code> resolves credentials from a stored secret."
          x-speakeasy-unknown-values: allow
          example: auto
        awsSecret:
          type: string
          description: Stored secret that holds the AWS access key and secret key pair.
            Used when <code>awsAuthenticationMethod</code> is
            <code>secret</code>.
          example: my-secret-id
        awsSecretKey:
          type: string
          description: Secret key when <code>awsAuthenticationMethod</code> is
            <code>manual</code>. Optional on AWS when using IAM roles.
          example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
        bucket:
          type: string
          description: S3 bucket name.
          minLength: 1
          example: my-bucket
        compression:
          type: boolean
          description: If <code>true</code>, enable compression for the persistent queue
            storage. Otherwise, <code>false</code> (default).
        enableAssumeRole:
          type: boolean
          description: If <code>true</code>, assume the role in <code>assumeRoleArn</code>
            using the base credentials from the chosen authentication method.
        endpoint:
          type: string
          description: Custom S3-compatible endpoint URL (for example, a MinIO instance).
            Omit to use the AWS default endpoint.
          example: https://s3.my-minio-instance.com:9000
        maxFileSize:
          type: string
          description: Maximum size of each persistent queue file before closing and
            optionally compressing. Value is a numeral and unit such as KB or
            MB. For <code>s3</code> and <code>nfs</code> storage types, the
            value must not exceed 100MB (parsed as a byte-size string).
          pattern: ^((\d*\.?\d+)((KB|MB|GB|TB|PB|EB|ZB|YB|kb|mb|gb|tb|pb|eb|zb|yb){1}))$
          example: 10MB
        maxSize:
          type: string
          description: Maximum disk space that the persistent queue can consume (as an
            average per Worker Process) before queueing stops. Value is a
            numeral and unit such as KB or MB. For <code>s3</code> and
            <code>nfs</code> storage types, the value must not exceed 2000 times
            the effective <code>maxFileSize</code> (including defaults where
            <code>maxFileSize</code> is omitted), after both are parsed to
            bytes.
          pattern: ^((\d*\.?\d+)((KB|MB|GB|TB|PB|EB|ZB|YB|kb|mb|gb|tb|pb|eb|zb|yb){1}))$
          example: 1GB
        optimizeCost:
          type: boolean
          description: If <code>true</code> (default), the system batches S3 object
            uploads to reduce API call volume and rate-limit risk at scale. If
            <code>false</code>, the system uploads sealed queue files to S3
            immediately, which results in greater API call volume and higher
            rate-limit risk.<br/><br/>If a node stops without graceful shutdown
            (for example, due to power loss), unreplicated data at risk is
            bounded by up to <code>maxFileSize</code> per PQ when
            <code>false</code>, and up to 2 &times; <code>maxFileSize</code> per
            PQ when <code>true</code>. Bounds apply per Worker Process, per
            PQ-enabled Source or Destination. A Worker Process crash without
            node loss does not lose events that were durably written to the
            local queue. These events are automatically recovered on restart.
        prefix:
          type: string
          description: Key prefix under which all PQ data is stored within the bucket.
          minLength: 1
          example: pq-data/my-worker-group/
        region:
          type: string
          description: AWS region. Falls back to the <code>AWS_DEFAULT_REGION</code>
            environment variable when omitted.
          example: us-west-2
        rejectUnauthorized:
          type: boolean
          description: If <code>false</code>, TLS certificate validation is disabled for
            the S3 endpoint (not recommended except for some S3-compatible
            endpoints).
        reuseConnections:
          type: boolean
          description: HTTP(S) keep-alive for the AWS SDK connection pool.
        type:
          type: string
          const: s3
          description: Storage type. Use <code>s3</code> for AWS S3 or S3-compatible
            object storage.
      required:
        - bucket
        - prefix
        - type
      title: PQStorageConfigS3
    PQStorageConfig:
      oneOf:
        - $ref: "#/components/schemas/PQStorageConfigFs"
        - $ref: "#/components/schemas/PQStorageConfigNfs"
        - $ref: "#/components/schemas/PQStorageConfigS3"
    AppscopeTransport:
      type: object
      properties:
        buffer:
          type: string
          enum:
            - line
            - full
          x-speakeasy-unknown-values: allow
        host:
          type: string
        path:
          type: string
        port:
          type: number
        tls:
          type: object
          properties:
            cacertpath:
              type: string
            enable:
              type: boolean
            validateserver:
              type: boolean
        type:
          type: string
    AppscopeConfig:
      type: object
      properties:
        cribl:
          $ref: "#/components/schemas/CriblTypeAppscopeConfig"
        event:
          $ref: "#/components/schemas/AppscopeConfigTypeNdjsonWithEnableConstraint"
        libscope:
          $ref: "#/components/schemas/LibscopeTypeAppscopeConfig"
        metric:
          $ref: "#/components/schemas/MetricTypeAppscopeConfig"
        payload:
          $ref: "#/components/schemas/PayloadTypeAppscopeConfig"
        protocol:
          type: array
          items:
            $ref: "#/components/schemas/ProtocolConfAppscopeConfig"
        tags:
          type: array
          items:
            $ref: "#/components/schemas/TagConfAppscopeConfig"
    AppscopeCustom:
      type: object
      properties:
        ancestor:
          type: string
        arg:
          type: string
        config:
          $ref: "#/components/schemas/AppscopeConfig"
        env:
          type: string
        hostname:
          type: string
        procname:
          type: string
        username:
          type: string
      required:
        - config
    AppscopeConfigWithCustom:
      type: object
      properties:
        cribl:
          $ref: "#/components/schemas/CriblTypeAppscopeConfig"
        custom:
          type: array
          items:
            $ref: "#/components/schemas/AppscopeCustom"
        event:
          $ref: "#/components/schemas/AppscopeConfigTypeNdjsonWithEnableConstraint"
        libscope:
          $ref: "#/components/schemas/LibscopeTypeAppscopeConfig"
        metric:
          $ref: "#/components/schemas/MetricTypeAppscopeConfig"
        payload:
          $ref: "#/components/schemas/PayloadTypeAppscopeConfig"
        protocol:
          type: array
          items:
            $ref: "#/components/schemas/ProtocolConfAppscopeConfig"
        tags:
          type: array
          items:
            $ref: "#/components/schemas/TagConfAppscopeConfig"
    AppscopeLibEntry:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/AppscopeConfigWithCustom"
        description:
          type: string
        id:
          type: string
        lib:
          $ref: "#/components/schemas/CriblLib"
        tags:
          type: string
      required:
        - config
        - description
        - id
        - lib
    CountedAppscopeLibEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AppscopeLibEntry"
    GrokFile:
      type: object
      properties:
        content:
          type: string
        id:
          type: string
        size:
          type: number
        tags:
          type: string
      required:
        - content
        - id
        - size
    CountedGrokFile:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GrokFile"
    CountedSavedJobResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SavedJobResponse"
    SavedJobResponseEnrichedFields:
      type: object
      properties:
        savedState:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeEnrichedFieldsSavedState"
          description: Runtime collection state.
        notifications:
          type: array
          items:
            $ref: "#/components/schemas/Notification"
          description: Notification targets.
    SavedJobResponseCollection:
      required:
        - collector
        - type
      properties:
        id:
          type: string
          title: Job ID
          pattern: ^[a-zA-Z0-9_-]+$
          description: Unique ID for this Job
        description:
          type: string
          title: Description
        type:
          $ref: "#/components/schemas/JobTypeOptionsRunnableJobCollection"
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        removeFields:
          type: array
          title: Remove Discover fields
          description: List of fields to remove from Discover results. Wildcards (for
            example, aws*) are allowed. This is useful when discovery returns
            sensitive fields that should not be exposed in the Jobs user
            interface.
          minItems: 0
          items:
            type: string
            title: Items
            description: List of fields to remove from Discover results
        resumeOnBoot:
          type: boolean
          title: Resume job on boot
          description: Resume the ad hoc job if a failure condition causes Stream to
            restart during job execution
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        schedule:
          $ref: "#/components/schemas/ScheduleTypeSavedJobResponseCollection"
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        workerAffinity:
          type: boolean
          title: Worker affinity
          description: If enabled, tasks are created and run by the same Worker Node
        collector:
          $ref: "#/components/schemas/Collector"
        input:
          $ref: "#/components/schemas/RunnableJobCollectionTypeCollectionWithBreakerRules\
            etsConstraint"
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      type: object
    SavedJobResponseExecutor:
      required:
        - executor
        - type
      properties:
        id:
          type: string
          title: Job ID
          pattern: ^[a-zA-Z0-9_-]+$
          description: Unique ID for this Job
        description:
          type: string
          title: Description
        type:
          $ref: "#/components/schemas/JobTypeOptionsRunnableJobCollection"
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        removeFields:
          type: array
          title: Remove Discover fields
          description: List of fields to remove from Discover results. Wildcards (for
            example, aws*) are allowed. This is useful when discovery returns
            sensitive fields that should not be exposed in the Jobs user
            interface.
          minItems: 0
          items:
            type: string
            title: Items
            description: List of fields to remove from Discover results
        resumeOnBoot:
          type: boolean
          title: Resume job on boot
          description: Resume the ad hoc job if a failure condition causes Stream to
            restart during job execution
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        schedule:
          $ref: "#/components/schemas/ScheduleTypeSavedJobResponseCollection"
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        executor:
          $ref: "#/components/schemas/ExecutorTypeRunnableJobExecutor"
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      type: object
    SavedJobResponseScheduledSearch:
      required:
        - savedQueryId
        - type
      properties:
        id:
          type: string
          title: Job ID
          pattern: ^[a-zA-Z0-9_-]+$
          description: Unique ID for this Job
        description:
          type: string
          title: Description
        type:
          $ref: "#/components/schemas/JobTypeOptionsRunnableJobCollection"
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        removeFields:
          type: array
          title: Remove Discover fields
          description: List of fields to remove from Discover results. Wildcards (for
            example, aws*) are allowed. This is useful when discovery returns
            sensitive fields that should not be exposed in the Jobs user
            interface.
          minItems: 0
          items:
            type: string
            title: Items
            description: List of fields to remove from Discover results
        resumeOnBoot:
          type: boolean
          title: Resume job on boot
          description: Resume the ad hoc job if a failure condition causes Stream to
            restart during job execution
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        schedule:
          $ref: "#/components/schemas/ScheduleTypeSavedJobResponseCollection"
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        savedQueryId:
          type: string
          title: ID of the SavedQuery
          description: Identifies which search query to run
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      type: object
    SavedJobResponse:
      allOf:
        - $ref: "#/components/schemas/SavedJobResponseEnrichedFields"
        - oneOf:
            - $ref: "#/components/schemas/SavedJobResponseCollection"
            - $ref: "#/components/schemas/SavedJobResponseExecutor"
            - $ref: "#/components/schemas/SavedJobResponseScheduledSearch"
    SavedJobCollection:
      required:
        - collector
        - type
      properties:
        id:
          type: string
          title: Job ID
          pattern: ^[a-zA-Z0-9_-]+$
          description: Unique ID for this Job
        description:
          type: string
          title: Description
        type:
          $ref: "#/components/schemas/JobTypeOptionsRunnableJobCollection"
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        removeFields:
          type: array
          title: Remove Discover fields
          description: List of fields to remove from Discover results. Wildcards (for
            example, aws*) are allowed. This is useful when discovery returns
            sensitive fields that should not be exposed in the Jobs user
            interface.
          minItems: 0
          items:
            type: string
            title: Items
            description: List of fields to remove from Discover results
        resumeOnBoot:
          type: boolean
          title: Resume job on boot
          description: Resume the ad hoc job if a failure condition causes Stream to
            restart during job execution
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        schedule:
          $ref: "#/components/schemas/ScheduleTypeSavedJobResponseCollection"
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        workerAffinity:
          type: boolean
          title: Worker affinity
          description: If enabled, tasks are created and run by the same Worker Node
        collector:
          $ref: "#/components/schemas/Collector"
        input:
          $ref: "#/components/schemas/RunnableJobCollectionTypeCollectionWithBreakerRules\
            etsConstraint"
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      type: object
    SavedJobExecutor:
      required:
        - executor
        - type
      properties:
        id:
          type: string
          title: Job ID
          pattern: ^[a-zA-Z0-9_-]+$
          description: Unique ID for this Job
        description:
          type: string
          title: Description
        type:
          $ref: "#/components/schemas/JobTypeOptionsRunnableJobCollection"
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        removeFields:
          type: array
          title: Remove Discover fields
          description: List of fields to remove from Discover results. Wildcards (for
            example, aws*) are allowed. This is useful when discovery returns
            sensitive fields that should not be exposed in the Jobs user
            interface.
          minItems: 0
          items:
            type: string
            title: Items
            description: List of fields to remove from Discover results
        resumeOnBoot:
          type: boolean
          title: Resume job on boot
          description: Resume the ad hoc job if a failure condition causes Stream to
            restart during job execution
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        schedule:
          $ref: "#/components/schemas/ScheduleTypeSavedJobResponseCollection"
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        executor:
          $ref: "#/components/schemas/ExecutorTypeRunnableJobExecutor"
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      type: object
    SavedJobScheduledSearch:
      required:
        - savedQueryId
        - type
      properties:
        id:
          type: string
          title: Job ID
          pattern: ^[a-zA-Z0-9_-]+$
          description: Unique ID for this Job
        description:
          type: string
          title: Description
        type:
          $ref: "#/components/schemas/JobTypeOptionsRunnableJobCollection"
        ttl:
          type: string
          title: Time to live
          description: Time to keep the job's artifacts on disk after job completion. This
            also affects how long a job is listed in the Job Inspector.
          pattern: \d+[smh]$
        ignoreGroupJobsLimit:
          type: boolean
          title: Ignore Worker Group job limits
          description: When enabled, this job's artifacts are not counted toward the
            Worker Group's finished job artifacts limit. Artifacts will be
            removed only after the Collector's configured time to live.
        removeFields:
          type: array
          title: Remove Discover fields
          description: List of fields to remove from Discover results. Wildcards (for
            example, aws*) are allowed. This is useful when discovery returns
            sensitive fields that should not be exposed in the Jobs user
            interface.
          minItems: 0
          items:
            type: string
            title: Items
            description: List of fields to remove from Discover results
        resumeOnBoot:
          type: boolean
          title: Resume job on boot
          description: Resume the ad hoc job if a failure condition causes Stream to
            restart during job execution
        environment:
          type: string
          title: Environment
          description: Optionally, enable this config only on a specified Git branch. If
            empty, will be enabled everywhere.
        schedule:
          $ref: "#/components/schemas/ScheduleTypeSavedJobResponseCollection"
        streamtags:
          type: array
          title: Tags
          description: Tags for filtering and grouping in @{product}
          items:
            type: string
        savedQueryId:
          type: string
          title: ID of the SavedQuery
          description: Identifies which search query to run
        __template_streamtags:
          type: string
          description: Binds 'streamtags' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'streamtags' at runtime.
      type: object
    SavedJob:
      oneOf:
        - $ref: "#/components/schemas/SavedJobCollection"
        - $ref: "#/components/schemas/SavedJobExecutor"
        - $ref: "#/components/schemas/SavedJobScheduledSearch"
    CollectorType:
      type: string
      enum:
        - azure_blob
        - cribl_lake
        - database
        - filesystem
        - google_cloud_storage
        - health_check
        - rest
        - s3
        - script
        - splunk
      x-speakeasy-unknown-values: allow
    CountedLookupFile:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/LookupFile"
    LookupFile:
      type: object
      required:
        - id
      properties:
        id:
          title: Filename
          type: string
          pattern: ^\w[\w -]+(?:\.csv|\.gz|\.csv\.gz|\.mmdb)?$
        description:
          type: string
          title: Description
        tags:
          type: string
          title: Tags
        size:
          type: number
          description: File size. Optional.
        version:
          type: string
          description: Unique string generated for each modification of this lookup
          readOnly: true
        mode:
          type: string
          title: Mode
          enum:
            - memory
            - disk
          x-speakeasy-unknown-values: allow
        pendingTask:
          type: object
          readOnly: true
          properties:
            id:
              type: string
              description: Task ID (generated).
              readOnly: true
            type:
              type: string
              description: Task type
              enum:
                - IMPORT
                - INDEX
              readOnly: true
              x-speakeasy-unknown-values: allow
            error:
              type: string
              description: Error message if task has failed
              readOnly: true
      anyOf:
        - properties:
            fileInfo:
              type: object
              required:
                - filename
              properties:
                filename:
                  type: string
                  pattern: ^\w[\w .-]+$
        - properties:
            content:
              type: string
              description: File content.
    Context:
      type: object
      properties:
        sessionId:
          type: string
      title: Context
    LookupCloneBody:
      type: object
      properties:
        context:
          oneOf:
            - type: "null"
            - $ref: "#/components/schemas/Context"
          description: The target context to clone the Lookup into. Use <code>null</code>
            to clone to the global context.
        newId:
          type: string
          description: Unique identifier for the cloned Lookup.
      required:
        - context
        - newId
    LookupFileInfoResponse:
      type: object
      properties:
        filename:
          type: string
        rows:
          type: number
        size:
          type: number
      required:
        - filename
        - rows
        - size
    LookupFileInfo:
      type: object
      required:
        - filename
      properties:
        filename:
          type: string
          pattern: ^\w[\w .-]+$
    ParserLibEntry:
      type: object
      additionalProperties: true
      required:
        - id
        - type
      properties:
        id:
          type: string
          title: ID
          pattern: ^[a-zA-Z0-9_-]+$
        lib:
          type: string
          title: Library
        description:
          type: string
          title: Description
        tags:
          type: string
          title: Tags
          description: Optionally, add tags that you can use for filtering
        type:
          $ref: "#/components/schemas/TypeOptions"
    CountedParserLibEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ParserLibEntry"
    CountedProtobufEncodingConfig:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ProtobufEncodingConfig"
    ProtobufEncodingConfig:
      type: object
      properties:
        eventModel:
          type: string
        id:
          type: string
        name:
          type: string
        wrapping:
          type: object
          properties:
            wrapperField:
              type: string
            wrapperFieldType:
              type: string
              enum:
                - single
                - array
              x-speakeasy-unknown-values: allow
            wrapperModel:
              type: string
          required:
            - wrapperField
            - wrapperFieldType
            - wrapperModel
      required:
        - eventModel
        - id
        - name
    CountedProtobufLibraryConfig:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ProtobufLibraryConfig"
    ProtobufBytesConversion:
      type: string
      enum:
        - buffer
        - array
        - string
      x-speakeasy-unknown-values: allow
    ProtobufEnumConversion:
      type: string
      enum:
        - string
        - number
      x-speakeasy-unknown-values: allow
    ProtobufLongConversion:
      type: string
      enum:
        - number
        - string
        - object
      x-speakeasy-unknown-values: allow
    ProtobufLibraryConversionConfig:
      type: object
      properties:
        arrays:
          type: boolean
        bytes:
          $ref: "#/components/schemas/ProtobufBytesConversion"
        defaults:
          type: boolean
        enums:
          $ref: "#/components/schemas/ProtobufEnumConversion"
        json:
          type: boolean
        longs:
          $ref: "#/components/schemas/ProtobufLongConversion"
        objects:
          type: boolean
        oneofs:
          type: boolean
    ProtobufLibraryConfig:
      type: object
      properties:
        availableEncodings:
          type: array
          items:
            $ref: "#/components/schemas/ProtobufEncodingConfig"
        conversion:
          $ref: "#/components/schemas/ProtobufLibraryConversionConfig"
        dependsOn:
          type: array
          items:
            type: string
        description:
          type: string
        id:
          type: string
        name:
          type: string
        tags:
          type: string
      required:
        - dependsOn
        - description
        - id
        - name
    RegexLibEntry:
      type: object
      additionalProperties: false
      required:
        - id
        - regex
      properties:
        id:
          type: string
          title: ID
          pattern: ^[a-zA-Z0-9_-]+$
        lib:
          type: string
          title: Library
        description:
          type: string
          title: Description
        regex:
          type: string
          title: Regex pattern
        sampleData:
          type: string
          title: Sample data
          description: Optionally, paste in sample data to match against this regex
          maxLength: 4096
        tags:
          type: string
          title: Tags
    CountedRegexLibEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/RegexLibEntry"
    SensitiveDataContextKeyword:
      type: object
      properties:
        keyword:
          type: string
        placement:
          type: string
          enum:
            - before
            - after
          x-speakeasy-unknown-values: allow
      required:
        - keyword
    SensitiveDataRule:
      type: object
      properties:
        contextKeywords:
          type: array
          items:
            $ref: "#/components/schemas/SensitiveDataContextKeyword"
        description:
          type: string
        id:
          type: string
        lib:
          $ref: "#/components/schemas/CriblLib"
        regex:
          type: string
        rulesets:
          type: array
          items:
            type: string
      required:
        - id
        - regex
        - rulesets
    CountedSensitiveDataRule:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SensitiveDataRule"
    SensitiveDataRuleset:
      type: object
      properties:
        count:
          type: number
        id:
          type: string
          description: Unique identifier.
        lib:
          type: string
      required:
        - id
    CountedSensitiveDataRuleset:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SensitiveDataRuleset"
    DataSample:
      type: object
      additionalProperties: true
      required:
        - id
        - sampleName
      properties:
        id:
          type: string
          title: ID
        sampleName:
          type: string
          title: File name
        pipelineId:
          type: string
          title: Associate with Pipeline
          description: Select a pipeline to associate with sample with. Select GLOBAL if
            not sure. Deprecated.
        description:
          type: string
          title: Description
          description: Brief description of this sample file. Optional.
        ttl:
          type: number
          title: Expiration (hours)
          description: Time to live (TTL) for the sample; reset after each use. Leave
            empty to never expire.
        tags:
          type: string
          title: Tags
          description: One or more tags related to this sample file. Optional.
    CountedDataSample:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DataSample"
    CountedSampleContent:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SampleContent"
    SampleContent:
      type: array
      items:
        type: object
        additionalProperties: true
    OnClickAction:
      type: object
      properties:
        search:
          type: string
          description: Search query string to execute on click.
        selectedDashboardId:
          type: string
          description: The <code>id</code> of the target Dashboard for drilldown navigation.
        selectedInputId:
          type: string
          description: The <code>id</code> of the Input element whose value is passed to
            the target Dashboard.
        selectedLinkId:
          type: string
          description: The <code>id</code> of the link element for external URL navigation.
        selectedTimerangeInputId:
          type: string
          description: The <code>id</code> of the time range Input element whose value is
            passed to the target Dashboard.
        type:
          type: string
          description: Action type.
          example: Add value to Dashboard Input
    AreaStyleOption:
      type: object
      properties:
        color:
          type: object
          additionalProperties: true
          description: Fill color for the area.
          example: rgba(0, 123, 255, 0.3)
        opacity:
          type: number
          description: Opacity of the area fill, from 0 (transparent) to 1 (opaque).
          minimum: 0
          maximum: 1
        shadowBlur:
          type: integer
          description: Blur radius of the shadow in pixels.
        shadowColor:
          type: string
          description: CSS color of the shadow.
          example: rgba(0, 0, 0, 0.5)
        shadowOffsetX:
          type: integer
          description: Horizontal offset of the shadow in pixels.
        shadowOffsetY:
          type: integer
          description: Vertical offset of the shadow in pixels.
      description: Fill and opacity settings for chart area regions.
    AreaStyleOptionString:
      type: object
      properties:
        color:
          type: object
          additionalProperties: true
          description: Fill color for the area.
          example: rgba(0, 123, 255, 0.3)
        opacity:
          type: number
          description: Opacity of the area fill, from 0 (transparent) to 1 (opaque).
          minimum: 0
          maximum: 1
        shadowBlur:
          type: integer
          description: Blur radius of the shadow in pixels.
        shadowColor:
          type: string
          description: CSS color of the shadow.
          example: rgba(0, 0, 0, 0.5)
        shadowOffsetX:
          type: integer
          description: Horizontal offset of the shadow in pixels.
        shadowOffsetY:
          type: integer
          description: Vertical offset of the shadow in pixels.
      description: Fill and opacity settings for chart area regions.
    ChartData:
      type: array
      items:
        type: object
        additionalProperties: true
      description: Array of data-point objects for chart series. Keys and value types
        vary by query and chart type.
    ChartType:
      type: string
      enum:
        - area
        - column
        - events
        - funnel
        - gauge
        - horizontalBar
        - line
        - map
        - pie
        - scatter
        - single
        - table
      x-speakeasy-unknown-values: allow
    ChartSeries:
      type: object
      properties:
        areaStyle:
          $ref: "#/components/schemas/AreaStyleOptionString"
          description: Area fill style options for area charts.
        color:
          type: string
          description: CSS color value for the series.
          example: "#FF0000"
        data:
          $ref: "#/components/schemas/ChartData"
          description: Array of data points for the series.
        map:
          type: string
          description: Map identifier for geo-chart series.
        name:
          type: string
          description: Name of the data series, displayed in legends and tooltips.
        type:
          $ref: "#/components/schemas/ChartType"
          description: Chart type override for the individual series.
        yAxisField:
          type: string
          description: Field name from the data to use for the Y-axis values.
      required:
        - name
    ChartAxisFormat:
      type: object
      properties:
        format:
          type: string
          description: Numeric format token. Unknown tokens are rendered as-is.
          example: "{0a}"
        prefix:
          type: string
          description: String prepended to the formatted numeric value.
        suffix:
          type: string
          description: String appended to the formatted numeric value.
      required:
        - format
      title: ChartAxisFormat
    ChartElementConfig:
      type: object
      properties:
        applyMode:
          $ref: "#/components/schemas/ApplyModeOptionsChartElementConfig"
        applyThreshold:
          type: boolean
          description: If <code>true</code>, apply color thresholds to the chart values.
        axis:
          $ref: "#/components/schemas/AxisTypeChartElementConfig"
        color:
          type: string
          description: CSS color value for single-value counters.
          example: "#5470C6"
        colorPalette:
          type: integer
          description: Index of the color palette to apply to the chart.
        colorPaletteReversed:
          type: boolean
          description: If <code>true</code>, reverse the color palette order.
        colorThresholds:
          $ref: "#/components/schemas/ColorThresholdsTypeChartElementConfig"
        customData:
          $ref: "#/components/schemas/CustomDataTypeChartElementConfig"
        debounceMs:
          type: integer
          description: Time (in milliseconds) to wait before auto-apply re-executes
            queries after Input element changes. Overrides the Dashboard-level
            setting for <code>autoApplyDebounceMs</code>.
        decimals:
          type: integer
          description: Number of decimal places for numeric display.
        label:
          type: string
          description: Display label for single-value counters.
        legend:
          $ref: "#/components/schemas/LegendTypeChartElementConfig"
        mapDetails:
          $ref: "#/components/schemas/MapDetailsTypeChartElementConfig"
        onClickAction:
          $ref: "#/components/schemas/OnClickAction"
          description: Action to perform when a user clicks on the chart.
        prefix:
          type: string
          description: String prepended to the displayed value.
        separator:
          type: boolean
          description: If <code>true</code>, apply thousands separators to numeric values.
        series:
          type: array
          items:
            $ref: "#/components/schemas/ChartSeries"
          description: Explicit series definitions with individual styling.
        seriesInfo:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/ChartType"
          description: Map of series names to display overrides (name, color, type, area
            style).
        shouldApplyUserChartSettings:
          type: boolean
          description: If <code>true</code>, apply user-level chart display preferences.
        style:
          type: boolean
          description: If <code>true</code>, apply custom styling to the chart.
        suffix:
          type: string
          description: String appended to the displayed value.
        timestats:
          type: boolean
          description: If <code>true</code>, displays time statistics on the chart.
        type:
          $ref: "#/components/schemas/ChartType"
          description: Default chart type for all series.
        xAxis:
          $ref: "#/components/schemas/XAxisTypeChartElementConfig"
        yAxis:
          $ref: "#/components/schemas/YAxisTypeChartElementConfig"
    DashboardLayout:
      type: object
      properties:
        h:
          type: integer
          description: Height of the element in grid rows.
        w:
          type: integer
          description: Width of the element in grid columns.
        x:
          type: integer
          description: Horizontal grid position (column index, zero-based).
        y:
          type: integer
          description: Vertical grid position (row index, zero-based).
      required:
        - h
        - w
        - x
        - y
    SavesSearchRunMode:
      type: string
      enum:
        - newSearch
        - lastRun
      x-speakeasy-unknown-values: allow
    SavedSearchQuery:
      type: object
      properties:
        query:
          type: string
        queryId:
          type: string
        runMode:
          $ref: "#/components/schemas/SavesSearchRunMode"
        type:
          type: string
          const: saved
      required:
        - queryId
        - type
      title: SavedSearchQuery
    ExpectedOutputType:
      type: string
      enum:
        - range
        - instant
      x-speakeasy-unknown-values: allow
    InlineSearchQuery:
      type: object
      properties:
        earliest:
          type:
            - string
            - number
            - "null"
        expectedOutputType:
          $ref: "#/components/schemas/ExpectedOutputType"
        latest:
          type:
            - string
            - number
            - "null"
        parentSearchId:
          type: string
        query:
          type:
            - string
            - "null"
        sampleRate:
          type: number
        timezone:
          type: string
        type:
          type: string
          const: inline
      required:
        - earliest
        - latest
        - query
        - type
      title: InlineSearchQuery
    ValuesSearchQuery:
      type: object
      properties:
        type:
          type: string
          const: values
        values:
          type: array
          items:
            type: string
      required:
        - type
        - values
      title: ValuesSearchQuery
    EmptySearchQuery:
      type: object
      properties:
        type:
          type: string
          const: empty
      required:
        - type
      title: EmptySearchQuery
    PanelQueryDefinition:
      type: object
      properties:
        alias:
          type: string
        localId:
          type: string
        query:
          type:
            - string
            - "null"
      required:
        - localId
        - query
    MetricSearchQuery:
      type: object
      properties:
        earliest:
          type:
            - string
            - number
            - "null"
        expectedOutputType:
          $ref: "#/components/schemas/ExpectedOutputType"
        latest:
          type:
            - string
            - number
            - "null"
        queries:
          type: array
          items:
            $ref: "#/components/schemas/PanelQueryDefinition"
        timezone:
          type: string
        type:
          type: string
          const: metric
      required:
        - earliest
        - latest
        - queries
        - type
      title: MetricSearchQuery
    SearchQuery:
      oneOf:
        - $ref: "#/components/schemas/SavedSearchQuery"
        - $ref: "#/components/schemas/InlineSearchQuery"
        - $ref: "#/components/schemas/ValuesSearchQuery"
        - $ref: "#/components/schemas/EmptySearchQuery"
        - $ref: "#/components/schemas/MetricSearchQuery"
    ColumnSetting:
      type: object
      additionalProperties:
        type: string
    ColumnSettingString:
      type: object
      additionalProperties:
        type: string
    ColumnFilterSettings:
      type: object
      properties:
        contains:
          $ref: "#/components/schemas/ColumnSettingString"
          description: Map of column IDs to substring filter values.
      required:
        - contains
    ColumnSettingAny:
      type: object
      additionalProperties: true
    ColumnSettingNumber:
      type: object
      additionalProperties:
        type: number
    ColumnFormatSettings:
      type: object
      properties:
        palette:
          $ref: "#/components/schemas/ColumnSettingAny"
          description: Map of column IDs to color palette configurations. Each value
            contains the palette index and optional color thresholds for
            conditional cell coloring.
        precision:
          $ref: "#/components/schemas/ColumnSettingNumber"
          description: Map of column IDs to decimal precision values.
        prefix:
          $ref: "#/components/schemas/ColumnSettingString"
          description: Map of column IDs to prefix strings.
        suffix:
          $ref: "#/components/schemas/ColumnSettingString"
          description: Map of column IDs to suffix strings.
      required:
        - palette
        - precision
        - prefix
        - suffix
    ColumnOrderSettings:
      type: object
      properties:
        order:
          $ref: "#/components/schemas/ColumnSettingNumber"
          description: Map of column IDs to display order indices.
      required:
        - order
    ColumnSettingSortOrder:
      type: object
      additionalProperties:
        type: string
        enum:
          - asc
          - desc
          - nosort
        x-speakeasy-unknown-values: allow
    ColumnSortSettings:
      type: object
      properties:
        sort:
          $ref: "#/components/schemas/ColumnSettingSortOrder"
          description: Map of column IDs to sort direction ('asc', 'desc', or 'nosort').
      required:
        - sort
    TableViewSettings:
      type: object
      properties:
        columnFilterSettings:
          $ref: "#/components/schemas/ColumnFilterSettings"
          description: Column-level filter settings for substring matching.
        columnFormatSettings:
          $ref: "#/components/schemas/ColumnFormatSettings"
          description: Column-level format settings (prefix, suffix, precision, palette).
        columnOrderSettings:
          $ref: "#/components/schemas/ColumnOrderSettings"
          description: Column display order settings.
        columnSortSettings:
          $ref: "#/components/schemas/ColumnSortSettings"
          description: Column-level sort settings.
        eventDetailsPanel:
          type: boolean
          description: If <code>true</code>, show the event details side panel when a row
            is selected.
        eventTableFields:
          type: array
          items:
            type: string
          description: List of field names to display as columns in the event table.
        rowNumberColumnWidth:
          type: integer
          description: Width in pixels of the row number column.
        showColumnTotals:
          type: boolean
          description: If <code>true</code>, display a column totals row at the bottom of
            the table.
        showColumnTotalsPinned:
          type: boolean
          description: If <code>true</code>, pin the column totals so that they remain
            visible when scrolling.
        showRowNumbers:
          type: boolean
          description: If <code>true</code>, display row numbers in the leftmost column.
        showRowTotals:
          type: boolean
          description: If <code>true</code>, display a row totals column at the end of
            each row.
        showRowTotalsPinned:
          type: boolean
          description: If <code>true</code>, pin the row totals so they remain visible
            when scrolling.
        wrapCells:
          type: boolean
          description: If <code>true</code>, wrap long cell content instead of truncating
            it.
      required:
        - showColumnTotals
        - showColumnTotalsPinned
        - showRowNumbers
        - showRowTotals
        - showRowTotalsPinned
        - wrapCells
    TitleAction:
      type: object
      properties:
        label:
          type: string
          description: Display text for the action link.
        openInNewTab:
          type: boolean
          description: If <code>true</code>, opens the link in a new browser tab.
        url:
          type: string
          description: Target URL for the action.
      required:
        - label
        - url
    ChartVisualizationElementType:
      type: string
      enum:
        - chart.area
        - chart.column
        - chart.funnel
        - chart.gauge
        - chart.horizontalBar
        - chart.line
        - chart.map
        - chart.pie
        - chart.scatter
        - counter.single
      title: ChartVisualizationElementType
      x-speakeasy-unknown-values: allow
    DashboardChartVisualization:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/ChartElementConfig"
          description: Chart-specific configuration (axes, series, colors, thresholds,
            etc.).
        description:
          type: string
          description: Brief description of the element, shown as a tooltip or subtitle.
        empty:
          type: boolean
          description: If <code>true</code>, the element has no associated query or data.
        group:
          type: string
          description: Key from the Dashboard <code>groups</code> object that associates
            the element with a group.
        hidePanel:
          type: boolean
          description: If <code>true</code>, hide the element's panel.
        horizontalChart:
          type: boolean
          description: If <code>true</code>, render the chart with a horizontal orientation.
        id:
          type: string
          description: Unique identifier for the element.
        index:
          type: integer
          description: Zero-based index of the element in the Dashboard
            <code>elements</code> array.
        layout:
          $ref: "#/components/schemas/DashboardLayout"
          description: Grid layout position and size for the element.
        search:
          $ref: "#/components/schemas/SearchQuery"
          description: Search query configuration that drives this visualization.
        tableConfig:
          $ref: "#/components/schemas/TableViewSettings"
          description: Table view settings for column filter, format, sort, and order.
        title:
          type: string
          description: Text displayed in the header of the element's panel.
        titleAction:
          $ref: "#/components/schemas/TitleAction"
          description: Clickable action link displayed alongside the element title.
        type:
          $ref: "#/components/schemas/ChartVisualizationElementType"
          description: Chart type.
          example: chart.line
        variant:
          type: string
          enum:
            - chart
            - visualization
          description: Element variant, either 'chart' or 'visualization'.
          x-speakeasy-unknown-values: allow
      required:
        - id
        - layout
        - search
        - type
      title: DashboardChartVisualization
    ColumnInfo:
      type: object
      properties:
        align:
          type: string
          enum:
            - left
            - right
          description: Horizontal text alignment within the column.
          x-speakeasy-unknown-values: allow
        id:
          type: string
          description: Unique identifier for the column.
        initialWidth:
          type: integer
          description: Initial width of the column in pixels before user resizing.
        maxWidth:
          type: integer
          description: Maximum width of the column in pixels.
        minWidth:
          type: integer
          description: Minimum width of the column in pixels.
        rowNumbers:
          type: boolean
          description: If <code>true</code>, the column displays row numbers.
        rowTotal:
          type: boolean
          description: If <code>true</code>, the column displays row totals.
        title:
          type: string
          description: Display title for the column header.
        type:
          type: string
          description: Data type of the column values.
          example: string
        width:
          type: integer
          description: Current width of the column in pixels.
      required:
        - id
        - minWidth
        - title
        - width
    EventViewerSettings:
      type: object
      properties:
        eventDetailsPanel:
          type: boolean
          description: If <code>true</code>, show the event details side panel when a row
            is selected.
        eventTableFields:
          type: array
          items:
            type: string
          description: List of field names to display as columns in the event table.
        rowNumberColumnWidth:
          type: integer
          description: Width in pixels of the row number column.
        showColumnTotals:
          type: boolean
          description: If <code>true</code>, display a column totals row at the bottom of
            the table.
        showColumnTotalsPinned:
          type: boolean
          description: If <code>true</code>, pin the column totals so that they remain
            visible when scrolling.
        showRowNumbers:
          type: boolean
          description: If <code>true</code>, display row numbers in the leftmost column.
        showRowTotals:
          type: boolean
          description: If <code>true</code>, display a row totals column at the end of
            each row.
        showRowTotalsPinned:
          type: boolean
          description: If <code>true</code>, pin the row totals so they remain visible
            when scrolling.
        viewMode:
          type: string
          enum:
            - event
            - table
          description: "Display mode.<br/><br/> <code>event</code>: Raw event view.<br/>
            <code>table</code>: Tabular view."
          x-speakeasy-unknown-values: allow
        wrapCells:
          type: boolean
          description: If <code>true</code>, wrap long cell content instead of truncating
            it.
      required:
        - showColumnTotals
        - showColumnTotalsPinned
        - showRowNumbers
        - showRowTotals
        - showRowTotalsPinned
        - viewMode
        - wrapCells
    EventsElementConfig:
      type: object
      properties:
        applyMode:
          $ref: "#/components/schemas/ApplyModeOptionsChartElementConfig"
        debounceMs:
          type: integer
          description: Time (in milliseconds) to wait before auto-apply re-executes
            queries after Input element changes. Overrides the Dashboard-level
            setting for <code>autoApplyDebounceMs</code>.
        eventTableColumns:
          type: array
          items:
            $ref: "#/components/schemas/ColumnInfo"
          description: Column definitions for the event table layout.
        eventViewerSettings:
          $ref: "#/components/schemas/EventViewerSettings"
          description: Display settings for the event viewer (view mode, row numbers,
            wrapping, etc.).
        onClickAction:
          $ref: "#/components/schemas/OnClickAction"
          description: Action to perform when a user clicks on an event row.
    EventsVisualizationElementType:
      type: string
      enum:
        - list.events
        - list.table
      title: EventsVisualizationElementType
      x-speakeasy-unknown-values: allow
    DashboardEventsVisualization:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/EventsElementConfig"
          description: Events-specific configuration (click actions, viewer settings,
            columns).
        description:
          type: string
          description: Brief description of the element, shown as a tooltip or subtitle.
        empty:
          type: boolean
          description: If <code>true</code>, the element has no associated query or data.
        group:
          type: string
          description: Key from the Dashboard <code>groups</code> object that associates
            the element with a group.
        hidePanel:
          type: boolean
          description: If <code>true</code>, hide the element's panel.
        horizontalChart:
          type: boolean
          description: If <code>true</code>, render the chart with a horizontal orientation.
        id:
          type: string
          description: Unique identifier for the element.
        index:
          type: integer
          description: Zero-based index of the element in the Dashboard
            <code>elements</code> array.
        layout:
          $ref: "#/components/schemas/DashboardLayout"
          description: Grid layout position and size for the element.
        search:
          $ref: "#/components/schemas/SearchQuery"
          description: Search query configuration that drives this visualization.
        title:
          type: string
          description: Text displayed in the header of the element's panel.
        titleAction:
          $ref: "#/components/schemas/TitleAction"
          description: Clickable action link displayed alongside the element title.
        type:
          $ref: "#/components/schemas/EventsVisualizationElementType"
          description: "Events display type: list.events or list.table."
        variant:
          type: string
          enum:
            - events
            - visualization
          description: Element variant, either 'events' or 'visualization'.
          x-speakeasy-unknown-values: allow
      required:
        - id
        - layout
        - search
        - type
      title: DashboardEventsVisualization
    ElementConfigType:
      type: object
      additionalProperties: true
    CustomVisualizationElementType:
      type: string
      enum:
        - custom.throughputMetrics
        - custom.flowMatrix
      title: CustomVisualizationElementType
      x-speakeasy-unknown-values: allow
    DashboardCustomVisualization:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/ElementConfigType"
          description: Visualization or Input configuration object.
        description:
          type: string
          description: Brief description of the element, shown as a tooltip or subtitle.
        empty:
          type: boolean
          description: If <code>true</code>, the element has no associated query or data.
        group:
          type: string
          description: Key from the Dashboard <code>groups</code> object that associates
            the element with a group.
        hidePanel:
          type: boolean
          description: If <code>true</code>, hide the element's panel.
        horizontalChart:
          type: boolean
          description: If <code>true</code>, render the chart with a horizontal orientation.
        id:
          type: string
          description: Unique identifier for the element.
        index:
          type: integer
          description: Zero-based index of the element in the Dashboard
            <code>elements</code> array.
        layout:
          $ref: "#/components/schemas/DashboardLayout"
          description: Grid layout position and size for the element.
        search:
          $ref: "#/components/schemas/SearchQuery"
          description: Search query configuration that drives this visualization.
        title:
          type: string
          description: Text displayed in the header of the element's panel.
        titleAction:
          $ref: "#/components/schemas/TitleAction"
          description: Clickable action link displayed alongside the element title.
        type:
          $ref: "#/components/schemas/CustomVisualizationElementType"
          description: Custom visualization type.
          example: custom.throughputMetrics
        variant:
          type: string
          const: visualization
          description: Element variant, always 'visualization' for custom visualizations.
      required:
        - id
        - layout
        - search
        - type
      title: DashboardCustomVisualization
    DashboardVisualization:
      oneOf:
        - $ref: "#/components/schemas/DashboardChartVisualization"
        - $ref: "#/components/schemas/DashboardEventsVisualization"
        - $ref: "#/components/schemas/DashboardCustomVisualization"
      title: DashboardVisualization
    TimeRange:
      type: object
      properties:
        earliest:
          type:
            - string
            - number
          description: Start of the time range (inclusive). Relative time string or epoch
            seconds.
        latest:
          type:
            - string
            - number
          description: End of the time range (exclusive). Relative time string or epoch
            seconds.
        timezone:
          type: string
          description: IANA timezone identifier.
          example: America/New_York
      required:
        - earliest
        - latest
      title: TimeRange
    InputElementConfig:
      type: object
      properties:
        applyMode:
          $ref: "#/components/schemas/ApplyModeOptionsChartElementConfig"
        debounceMs:
          type: integer
          description: Time (in milliseconds) to wait before auto-apply re-executes
            queries after Input element changes. Overrides the Dashboard-level
            setting for <code>autoApplyDebounceMs</code>.
        defaultValue:
          oneOf:
            - type: string
            - type: number
            - $ref: "#/components/schemas/TimeRange"
          description: "Default value for the Input element. Type depends on the Input
            type: string for text and dropdown Inputs, number for number Inputs,
            and ITimeRange object for timerange Inputs."
        field:
          type: string
          description: Field name to extract dropdown values from in search results.
        max:
          type: integer
          description: Maximum allowed value for number Inputs.
        min:
          type: integer
          description: Minimum allowed value for number Inputs.
        multiselect:
          type: boolean
          description: If <code>true</code>, the dropdown menu allows selecting multiple
            values.
        placeholder:
          type: string
          description: Placeholder text displayed when the Input is empty.
    InputElementType:
      type: string
      enum:
        - input.timerange
        - input.dropdown
        - input.text
        - input.number
      x-speakeasy-unknown-values: allow
    DashboardInput:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/InputElementConfig"
          description: Input-specific configuration (default value, placeholder,
            constraints).
        description:
          type: string
          description: Brief description of the element, shown as a tooltip or subtitle.
        empty:
          type: boolean
          description: If <code>true</code>, the element has no associated query or data.
        group:
          type: string
          description: Key from the Dashboard <code>groups</code> object that associates
            the element with a group.
        hidePanel:
          type: boolean
          description: If <code>true</code>, hide the element's panel.
        horizontalChart:
          type: boolean
          description: If <code>true</code>, render the chart with a horizontal orientation.
        id:
          type: string
          description: Unique identifier for the element.
        index:
          type: integer
          description: Zero-based index of the element in the Dashboard
            <code>elements</code> array.
        inputId:
          type: string
          description: Unique identifier of the token variable bound to the Input element.
        layout:
          $ref: "#/components/schemas/DashboardLayout"
          description: Grid layout position and size for the element.
        search:
          $ref: "#/components/schemas/SearchQuery"
          description: Search query that populates dropdown options. Only used when type
            is 'input.dropdown'.
        title:
          type: string
          description: Text displayed in the header of the element's panel.
        titleAction:
          $ref: "#/components/schemas/TitleAction"
          description: Clickable action link displayed alongside the element title.
        type:
          $ref: "#/components/schemas/InputElementType"
          description: Input element type.
          example: input.dropdown
        value:
          oneOf:
            - type: string
            - type: number
            - $ref: "#/components/schemas/TimeRange"
          description: "Current value of the Input element. Type depends on the Input
            type: string for text and dropdown Inputs, number for number Inputs,
            and ITimeRange object for timerange Inputs."
        variant:
          type: string
          const: input
          description: Element variant, always 'input' for Input elements.
      required:
        - id
        - inputId
        - layout
        - type
      title: DashboardInput
    MarkdownElementConfig:
      type: object
      properties:
        loading:
          type: boolean
          description: If <code>true</code>, Cribl Copilot content is still loading. Used
            only in markdown.copilot sections of Search Notebooks.
        markdown:
          type: string
          description: Markdown content to render in the element.
      required:
        - markdown
    MarkdownElementType:
      type: string
      enum:
        - markdown.copilot
        - markdown.default
      x-speakeasy-unknown-values: allow
    DashboardMarkdown:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/MarkdownElementConfig"
          description: Markdown-specific configuration (content, loading state).
        description:
          type: string
          description: Brief description of the element, shown as a tooltip or subtitle.
        empty:
          type: boolean
          description: If <code>true</code>, the element has no associated query or data.
        group:
          type: string
          description: Key from the Dashboard <code>groups</code> object that associates
            the element with a group.
        hidePanel:
          type: boolean
          description: If <code>true</code>, hide the element's panel.
        horizontalChart:
          type: boolean
          description: If <code>true</code>, render the chart with a horizontal orientation.
        id:
          type: string
          description: Unique identifier for the element.
        index:
          type: integer
          description: Zero-based index of the element in the Dashboard
            <code>elements</code> array.
        layout:
          $ref: "#/components/schemas/DashboardLayout"
          description: Grid layout position and size for the element.
        title:
          type: string
          description: Text displayed in the header of the element's panel.
        titleAction:
          $ref: "#/components/schemas/TitleAction"
          description: Clickable action link displayed alongside the element title.
        type:
          $ref: "#/components/schemas/MarkdownElementType"
          description: "Markdown element type: markdown.default or markdown.copilot."
        variant:
          type: string
          const: markdown
          description: Element variant. Always <code>markdown</code> for Markdown elements.
      required:
        - id
        - layout
        - type
        - variant
      title: DashboardMarkdown
    DashboardElement:
      oneOf:
        - $ref: "#/components/schemas/DashboardVisualization"
        - $ref: "#/components/schemas/DashboardInput"
        - $ref: "#/components/schemas/DashboardMarkdown"
    DashboardElements:
      type: array
      items:
        $ref: "#/components/schemas/DashboardElement"
    DashboardGroups:
      type: object
      additionalProperties:
        type: object
        properties:
          action:
            type: object
            properties:
              label:
                type: string
                description: Label text for the action button in the group header.
              params:
                type: object
                additionalProperties:
                  type: string
                description: Key-value pairs to add to the <code>target</code> URL path as query
                  parameters. Values can include tokens to resolve to Input
                  values when users select the action button.
              target:
                type: string
                description: The URL path to navigate to when users select the action button.
            required:
              - label
              - target
            description: Action button configuration for the group header.
          collapsed:
            type: boolean
            description: If <code>true</code>, the group is collapsed by default when users
              open the Dashboard. Default is <code>false</code> (expanded).
          inputId:
            type: string
            description: Identifier of an Input element to display in the group header
              instead of the top-level Input of the Dashboard.
          position:
            type: integer
            description: Numeric position of the Dashboard panel group. Groups with lower
              values appear first.
          title:
            type: string
            description: Display name for the Dashboard panel group.
          trackingId:
            type: string
            description: Unique identifier for analytics and tracking purposes. Rendered as
              the <code>data-tracking-id</code> attribute on the group header.
            example: system-health-overview
        required:
          - title
      description: Definitions of collapsible sections used to organize related panels
        in the Dashboard.
    SavedQuerySchedule:
      type: object
      properties:
        cronSchedule:
          type: string
          description: Unix cron expression (5 fields) that defines when the scheduled
            queries run.
          example: 0 0 * * *
        enabled:
          type: boolean
          description: If <code>true</code>, the schedule is active and the Dashboard
            queries run automatically at the specified
            <code>cronSchedule</code>.
        keepLastN:
          type: integer
          description: Minimum number of past execution artifacts to retain. Older
            artifacts are purged periodically. Default is <code>2</code>.
          minimum: 1
          maximum: 1000
        notifications:
          type: object
          properties:
            disabled:
              type: boolean
              description: If <code>true</code>, Notifications for the scheduled query are
                disabled. Default is <code>false</code> (Notifications enabled).
            items:
              type: array
              items:
                $ref: "#/components/schemas/Notification"
              description: List of Notification targets to receive alerts when the scheduled
                query completes.
          required:
            - disabled
          description: Notification settings for scheduled query executions.
        resumeMissed:
          type: boolean
          description: If <code>true</code> (default), run all missed scheduled executions
            after a Leader restart.
        resumeOnBoot:
          type: boolean
          description: If <code>true</code> (default), resume the scheduled job if a
            failure causes the system to restart during execution.
        tz:
          type: string
          description: IANA timezone identifier for the cron schedule.
          example: America/New_York
      required:
        - cronSchedule
        - enabled
        - keepLastN
        - tz
    SearchDashboard:
      type: object
      properties:
        autoApplyDebounceMs:
          type: integer
          description: Time (in milliseconds) to wait before auto-apply re-executes
            queries after Input changes. If the Input changes again within the
            specified interval, the time to wait resets. Default is
            <code>500</code>. Applies only if the Dashboard
            <code>autoApplyMode</code> is <code>metric</code> or
            <code>all</code> or an individual panel's <code>applyMode</code> is
            <code>auto</code>.
        autoApplyMode:
          $ref: "#/components/schemas/AutoApplyModeOptionsSearchDashboard"
        autoApplyUrlSync:
          $ref: "#/components/schemas/AutoApplyUrlSyncOptionsSearchDashboard"
        cacheTTLSeconds:
          type: integer
          description: Maximum time (in seconds) to serve cached query results for the
            Dashboard panels. When set, panels can reuse previous search results
            within the specified time window instead of running new searches.
        category:
          type: string
          description: Name of the Collection that the Dashboard belongs to.
        created:
          type: integer
          description: Timestamp (in Unix time) when the resource was created in
            milliseconds. Set by the server on save.
        createdBy:
          type: string
          description: User ID of the user who created the resource. Set by the server on
            save.
        description:
          type: string
          description: Brief description of the resource.
        displayCreatedBy:
          type: string
          description: Display username of the creator (resolved from user ID). Set by the
            server on save.
        displayModifiedBy:
          type: string
          description: Display username of the last modifier (resolved from user ID). Set
            by the server on save.
        elements:
          $ref: "#/components/schemas/DashboardElements"
          description: Ordered array of Dashboard elements, including visualizations,
            Inputs, and Markdown panels.
        groups:
          $ref: "#/components/schemas/DashboardGroups"
          description: Definitions of collapsible sections used to organize related
            elements in the Dashboard.
        id:
          type: string
          description: Unique identifier for the Dashboard.
        modified:
          type: integer
          description: Timestamp (in Unix time) when the resource was last modified, in
            milliseconds. Set by the server on save.
        modifiedBy:
          type: string
          description: User ID of the user who last modified the resource. Set by the
            server on save.
        name:
          type: string
          description: Display name of the resource.
        packId:
          type: string
          description: Unique identifier of the Pack that contains the Dashboard.
        refreshRate:
          type: integer
          description: Auto-refresh polling interval in milliseconds. When set, the
            Dashboard re-executes its queries at this interval while open in the
            Cribl UI.
        resolvedDatasetIds:
          type: array
          items:
            type: string
          description: List of the <code>id</code> for each Dataset that the Dashboard
            references.
        schedule:
          $ref: "#/components/schemas/SavedQuerySchedule"
          description: Schedule configuration for automatically executing Dashboard
            queries. The Dashboard computes and caches results to display when a
            user opens the Dashboard in the Cribl UI.
      required:
        - created
        - createdBy
        - elements
        - id
        - modified
        - name
    CountedSearchDashboard:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SearchDashboard"
    SearchDashboardInput:
      type: object
      properties:
        autoApplyDebounceMs:
          type: integer
          description: Time (in milliseconds) to wait before auto-apply re-executes
            queries after Input changes. If the Input changes again within the
            specified interval, the time to wait resets. Default is
            <code>500</code>. Applies only if the Dashboard
            <code>autoApplyMode</code> is <code>metric</code> or
            <code>all</code> or an individual panel's <code>applyMode</code> is
            <code>auto</code>.
        autoApplyMode:
          $ref: "#/components/schemas/AutoApplyModeOptionsSearchDashboard"
        autoApplyUrlSync:
          $ref: "#/components/schemas/AutoApplyUrlSyncOptionsSearchDashboard"
        cacheTTLSeconds:
          type: integer
          description: Maximum time (in seconds) to serve cached query results for the
            Dashboard panels. When set, panels can reuse previous search results
            within the specified time window instead of running new searches.
        category:
          type: string
          description: Name of the Collection that the Dashboard belongs to.
        description:
          type: string
          description: Brief description of the resource.
        elements:
          $ref: "#/components/schemas/DashboardElements"
          description: Ordered array of Dashboard elements, including visualizations,
            Inputs, and Markdown panels.
        groups:
          $ref: "#/components/schemas/DashboardGroups"
          description: Definitions of collapsible sections used to organize related
            elements in the Dashboard.
        id:
          type: string
          description: Unique identifier for the Dashboard.
        name:
          type: string
          description: Display name of the resource.
        packId:
          type: string
          description: Unique identifier of the Pack that contains the Dashboard.
        refreshRate:
          type: integer
          description: Auto-refresh polling interval in milliseconds. When set, the
            Dashboard re-executes its queries at this interval while open in the
            Cribl UI.
        resolvedDatasetIds:
          type: array
          items:
            type: string
          description: List of the <code>id</code> for each Dataset that the Dashboard
            references.
        schedule:
          $ref: "#/components/schemas/SavedQuerySchedule"
          description: Schedule configuration for automatically executing Dashboard
            queries. The Dashboard computes and caches results to display when a
            user opens the Dashboard in the Cribl UI.
      required:
        - elements
        - id
        - name
    SearchMacro:
      type: object
      properties:
        created:
          type: integer
          description: Timestamp (in Unix time) when the Macro was created (milliseconds).
        createdBy:
          type: string
          description: Username of the user who created the Macro.
        description:
          type: string
          description: Brief description of the Macro.
        id:
          type: string
          description: Unique identifier for the Macro.
        modified:
          type: integer
          description: Timestamp (in Unix time) for when the Macro was last modified
            (milliseconds).
        replacement:
          type: string
          description: Query fragment that is substituted when the Macro is referenced in
            a search.
        tags:
          type: string
          description: Tag used to filter Macros.
      required:
        - id
        - replacement
    CountedSearchMacro:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SearchMacro"
    NotebookDisplayConfig:
      type: object
      properties:
        collapsedSections:
          oneOf:
            - type: boolean
            - type: array
              items:
                type: string
            - type: "null"
          description: Sections to collapse when the Notebook loads. Set to
            <code>true</code> to collapse all sections, or provide an array of
            section <code>id</code> values to collapse specific sections.
            Default is <code>false</code> (all sections expanded).
        fullWidthSections:
          oneOf:
            - type: boolean
            - type: array
              items:
                type: string
            - type: "null"
          description: Sections to display at full width when the Notebook loads. Set to
            <code>true</code> to display all sections at full width, or provide
            an array of section <code>id</code> values to display specific
            sections at full width. Default is <code>false</code> (do not
            display any sections at full width).
      required:
        - collapsedSections
        - fullWidthSections
    NotebookGenerationConfig:
      type: object
      properties:
        notebookDescription:
          type: string
          description: Description to assign to Notebooks generated from the template.
            Supports template token substitution.
        notebookName:
          type: string
          description: Name to assign to Notebooks generated from the template. Supports
            template token substitution.
    NotebookInteractionConfig:
      type: object
      properties:
        forceRunOnLoad:
          oneOf:
            - type: boolean
            - enum:
                - once
              x-speakeasy-unknown-values: allow
          description: 'Automatic search execution behavior for visualization sections
            when the Notebook loads.<br/><br/> <code>true</code>: Execute the
            searches for all visualization sections every time the Notebook
            loads.<br/> <code>"once"</code>: Execute the searches for all
            visualization sections only the first time the Notebook loads, then
            reset to <code>false</code>.<br/> <code>false</code>: Load existing
            search results from previous runs in <code>runInfo</code> and do not
            execute searches when the Notebook loads.'
        lockEditing:
          type: boolean
          description: If <code>true</code>, prevent the Notebook from being edited.
      required:
        - forceRunOnLoad
        - lockEditing
    TemplateConfig:
      type: object
      properties:
        display:
          $ref: "#/components/schemas/NotebookDisplayConfig"
          description: Display settings for the Notebook layout.
        generation:
          $ref: "#/components/schemas/NotebookGenerationConfig"
          description: Settings for generating Notebooks from the template.
        interaction:
          $ref: "#/components/schemas/NotebookInteractionConfig"
          description: Interaction settings for run-on-load and editing behavior.
    CreatedFromType:
      type: string
      enum:
        - dashboard
        - notebook
        - savedSearch
        - searchJob
        - template
      x-speakeasy-unknown-values: allow
    CreatedFrom:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the source Notebook or template used to create
            the Notebook.
        name:
          type:
            - string
            - "null"
          description: Name of the source Notebook or template used to create the Notebook.
        type:
          $ref: "#/components/schemas/CreatedFromType"
          description: "The type of the source that was used to create the Notebook:
            <code>template</code>, <code>notebook</code>,
            <code>savedSearch</code>, <code>searchJob</code>,
            <code>dashboard</code>."
      required:
        - id
        - name
        - type
    TemplateOrigin:
      type: string
      enum:
        - cribl
        - packs
        - user
      x-speakeasy-unknown-values: allow
    TemplateInfo:
      type: object
      properties:
        created:
          type: integer
          description: Timestamp (in Unix time) when the resource was created in
            milliseconds. Set by the server on save.
        createdBy:
          type: string
          description: User ID of the user who created the resource. Set by the server on
            save.
        createdFrom:
          $ref: "#/components/schemas/CreatedFrom"
          description: Reference to the source Notebook or template that was used to
            create the Notebook.
        description:
          type: string
          description: Brief description of the resource.
        displayCreatedBy:
          type: string
          description: Display username of the creator (resolved from user ID). Set by the
            server on save.
        displayModifiedBy:
          type: string
          description: Display username of the last modifier (resolved from user ID). Set
            by the server on save.
        modified:
          type: integer
          description: Timestamp (in Unix time) when the resource was last modified, in
            milliseconds. Set by the server on save.
        modifiedBy:
          type: string
          description: User ID of the user who last modified the resource. Set by the
            server on save.
        name:
          type: string
          description: Display name of the resource.
        origin:
          $ref: "#/components/schemas/TemplateOrigin"
          description: "Origin of the Notebook template.<br/><br/> <code>user</code>: A
            user created the template.<br/> <code>cribl</code>: The template is
            built in to Cribl.<br/> <code>packs</code>: The template was
            installed from a Pack."
        templateVersion:
          type: integer
          description: Incremental version number of the Notebook template. Starts at 0
            and increments with each update.
      required:
        - created
        - createdBy
        - modified
        - name
        - origin
        - templateVersion
    V1:
      type: integer
      const: 0
    SectionInfo:
      type: object
      properties:
        created:
          type: integer
          description: Timestamp (in Unix time) when the resource was created in
            milliseconds. Set by the server on save.
        createdBy:
          type: string
          description: User ID of the user who created the resource. Set by the server on
            save.
        description:
          type: string
          description: Brief description of the Notebook section.
        displayCreatedBy:
          type: string
          description: Display username of the creator (resolved from user ID). Set by the
            server on save.
        displayModifiedBy:
          type: string
          description: Display username of the last modifier (resolved from user ID). Set
            by the server on save.
        modified:
          type: integer
          description: Timestamp (in Unix time) when the resource was last modified, in
            milliseconds. Set by the server on save.
        modifiedBy:
          type: string
          description: User ID of the user who last modified the resource. Set by the
            server on save.
        title:
          type: string
          description: Display title for the Notebook section.
      required:
        - created
        - createdBy
        - modified
    VisualizationElementType:
      type: string
      enum:
        - chart.area
        - chart.column
        - chart.funnel
        - chart.gauge
        - chart.horizontalBar
        - chart.line
        - chart.map
        - chart.pie
        - chart.scatter
        - counter.single
        - list.events
        - list.table
        - custom.throughputMetrics
        - custom.flowMatrix
      x-speakeasy-unknown-values: allow
    TemplateVisualizationSection:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/ElementConfigType"
          description: Visualization or Input configuration object.
        displayConfig:
          $ref: "#/components/schemas/DisplayConfigTypeTemplateVisualizationSection"
        id:
          type: string
          description: Unique identifier for the element.
        info:
          $ref: "#/components/schemas/SectionInfo"
        search:
          $ref: "#/components/schemas/SearchQuery"
          description: Search query configuration that drives this visualization.
        type:
          $ref: "#/components/schemas/VisualizationElementType"
          description: Visualization type.
          example: chart.line
        variant:
          $ref: "#/components/schemas/VariantOptionsTemplateVisualizationSection"
      required:
        - id
        - info
        - search
        - type
        - variant
      title: TemplateVisualizationSection
    TemplateMarkdownSection:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/MarkdownElementConfig"
          description: Markdown-specific configuration (content, loading state).
        displayConfig:
          $ref: "#/components/schemas/DisplayConfigTypeTemplateVisualizationSection"
        id:
          type: string
          description: Unique identifier for the element.
        info:
          $ref: "#/components/schemas/SectionInfo"
        type:
          $ref: "#/components/schemas/MarkdownElementType"
          description: "Markdown element type: markdown.default or markdown.copilot."
        variant:
          type: string
          const: markdown
          description: Element variant. Always <code>markdown</code> for Markdown elements.
      required:
        - id
        - info
        - type
        - variant
      title: TemplateMarkdownSection
    TemplateSection:
      oneOf:
        - $ref: "#/components/schemas/TemplateVisualizationSection"
        - $ref: "#/components/schemas/TemplateMarkdownSection"
    BooleanToken:
      type: object
      properties:
        defaultValue:
          type: boolean
        description:
          type: string
        token:
          type: string
        type:
          type: string
          const: boolean
      required:
        - token
        - type
      title: BooleanToken
    DatetimeToken:
      type: object
      properties:
        defaultValue:
          oneOf:
            - type: number
            - enum:
                - now
              x-speakeasy-unknown-values: allow
        description:
          type: string
        token:
          type: string
        type:
          type: string
          const: datetime
      required:
        - token
        - type
      title: DatetimeToken
    DropdownToken:
      type: object
      properties:
        defaultValue:
          type: string
        description:
          type: string
        token:
          type: string
        type:
          type: string
          const: dropdown
        values:
          type: array
          items:
            type: string
      required:
        - token
        - type
        - values
      title: DropdownToken
    NumberToken:
      type: object
      properties:
        defaultValue:
          type: number
        description:
          type: string
        token:
          type: string
        type:
          type: string
          const: number
      required:
        - token
        - type
      title: NumberToken
    TextToken:
      type: object
      properties:
        defaultValue:
          type: string
        description:
          type: string
        token:
          type: string
        type:
          type: string
          const: text
      required:
        - token
        - type
      title: TextToken
    TemplateToken:
      oneOf:
        - $ref: "#/components/schemas/BooleanToken"
        - $ref: "#/components/schemas/DatetimeToken"
        - $ref: "#/components/schemas/DropdownToken"
        - $ref: "#/components/schemas/NumberToken"
        - $ref: "#/components/schemas/TextToken"
    NotebookTemplate:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/TemplateConfig"
          description: Configuration for Notebook template display, interaction, and
            generation behavior.
        id:
          type: string
          description: Unique identifier for the Notebook.
        info:
          $ref: "#/components/schemas/TemplateInfo"
          description: Metadata for the Notebook template.
        resolvedDatasetIds:
          type: array
          items:
            type: string
          description: List of the <code>id</code> for each Dataset that the Dashboard
            references.
        schemaVersion:
          $ref: "#/components/schemas/V1"
          description: Schema version of the Notebook format.
        sectionCount:
          type: integer
          description: Number of sections in the Notebook.
        sections:
          type: array
          items:
            $ref: "#/components/schemas/TemplateSection"
          description: Ordered array of sections in the Notebook template.
        tokens:
          type: array
          items:
            $ref: "#/components/schemas/TemplateToken"
          description: Substitution tokens that are resolved when generating a Notebook
            from the template. Each token defines a variable with a type and
            optional default value.
      required:
        - id
        - info
        - sections
        - tokens
    CountedNotebookTemplate:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/NotebookTemplate"
    TemplateInfoInput:
      type: object
      properties:
        createdFrom:
          $ref: "#/components/schemas/CreatedFrom"
          description: Reference to the source Notebook or template that was used to
            create the Notebook.
        description:
          type: string
          description: Brief description of the resource.
        name:
          type: string
          description: Display name of the resource.
      required:
        - name
    NotebookTemplateInput:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/TemplateConfig"
          description: Configuration for Notebook template display, interaction, and
            generation behavior.
        id:
          type: string
          description: Unique identifier for the Notebook.
        info:
          $ref: "#/components/schemas/TemplateInfoInput"
          description: Metadata for the Notebook template. Server-managed fields
            (<code>created</code>, <code>createdBy</code>,
            <code>modified</code>, <code>origin</code>,
            <code>templateVersion</code>) are set automatically.
        resolvedDatasetIds:
          type: array
          items:
            type: string
          description: List of the <code>id</code> for each Dataset that the Dashboard
            references.
        schemaVersion:
          $ref: "#/components/schemas/V1"
          description: Schema version of the Notebook format.
        sectionCount:
          type: integer
          description: Number of sections in the Notebook.
        sections:
          type: array
          items:
            $ref: "#/components/schemas/TemplateSection"
          description: Ordered array of sections in the Notebook template.
        tokens:
          type: array
          items:
            $ref: "#/components/schemas/TemplateToken"
          description: Substitution tokens that are resolved when generating a Notebook
            from the template. Each token defines a variable with a type and
            optional default value.
      required:
        - id
        - info
        - sections
        - tokens
    ChartConfig:
      type: object
      properties:
        applyThreshold:
          type: boolean
          description: If <code>true</code>, apply color thresholds to the chart values.
        axis:
          $ref: "#/components/schemas/AxisTypeChartElementConfig"
        color:
          type: string
          description: CSS color value for single-value counters.
          example: "#5470C6"
        colorPalette:
          type: integer
          description: Index of the color palette to apply to the chart.
        colorPaletteReversed:
          type: boolean
          description: If <code>true</code>, reverse the color palette order.
        colorThresholds:
          $ref: "#/components/schemas/ColorThresholdsTypeChartElementConfig"
        customData:
          $ref: "#/components/schemas/CustomDataTypeChartElementConfig"
        decimals:
          type: integer
          description: Number of decimal places for numeric display.
        label:
          type: string
          description: Display label for single-value counters.
        legend:
          $ref: "#/components/schemas/LegendTypeChartElementConfig"
        mapDetails:
          $ref: "#/components/schemas/MapDetailsTypeChartElementConfig"
        onClickAction:
          $ref: "#/components/schemas/OnClickAction"
          description: Action to perform when a user clicks on the chart.
        prefix:
          type: string
          description: String prepended to the displayed value.
        separator:
          type: boolean
          description: If <code>true</code>, apply thousands separators to numeric values.
        series:
          type: array
          items:
            $ref: "#/components/schemas/ChartSeries"
          description: Explicit series definitions with individual styling.
        seriesInfo:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/ChartType"
          description: Map of series names to display overrides (name, color, type, area
            style).
        shouldApplyUserChartSettings:
          type: boolean
          description: If <code>true</code>, apply user-level chart display preferences.
        style:
          type: boolean
          description: If <code>true</code>, apply custom styling to the chart.
        suffix:
          type: string
          description: String appended to the displayed value.
        type:
          $ref: "#/components/schemas/ChartType"
          description: Default chart type for all series.
        xAxis:
          $ref: "#/components/schemas/XAxisTypeChartElementConfig"
        yAxis:
          $ref: "#/components/schemas/YAxisTypeChartElementConfig"
    SavedQuery:
      type: object
      properties:
        chartConfig:
          $ref: "#/components/schemas/ChartConfig"
          description: Chart configuration for scheduled or Dashboard-backed runs.
        description:
          type: string
          description: Brief description of the saved search.
        displayUsername:
          type: string
          description: Display name for the user who created the saved search.
        earliest:
          type: string
          description: Start of the search time range. Accepts a relative time string or
            an absolute timestamp.
        id:
          type: string
          description: Unique identifier for the saved search.
        isPrivate:
          type: boolean
          description: If <code>true</code>, job results are restricted to the owner.
        isSystem:
          type: boolean
        latest:
          type: string
          description: End of the search time range. Accepts a relative time string or an
            absolute timestamp.
        lib:
          $ref: "#/components/schemas/CriblLib"
          description: Library scope for the saved search. Indicates whether the
            definition is built-in or custom.
        name:
          type: string
          description: Display name for the saved search.
        query:
          type: string
          description: Query text for the saved search.
        resolvedDatasetIds:
          type: array
          items:
            type: string
          description: Dataset identifiers that are resolved from the query for role-based
            access control (RBAC) and scheduling.
        sampleRate:
          type: number
          description: Sampling rate that is applied to events, between 0 and 1.
        schedule:
          $ref: "#/components/schemas/SavedQuerySchedule"
          description: Cron schedule and Notification settings for the saved search when
            it runs on a schedule.
        searchJobSource:
          type: string
          enum:
            - agentic
            - command
            - dashboard
            - datatypePreview
            - notebook
            - scheduled
            - standard
            - systemInsights
          description: Source context that created the job.
          x-speakeasy-unknown-values: allow
        tableConfig:
          type: object
          additionalProperties: true
          description: Table layout configuration.
        timezone:
          type: string
          description: IANA timezone for scheduled execution.
        user:
          type: string
          description: Identifier for the user who created the saved search. Scheduled
            runs execute as the specified user.
      required:
        - id
        - name
        - query
    CountedSavedQuery:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SavedQuery"
    CountedNotification:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Notification"
    CPUTimeMetric:
      type: object
      properties:
        billableCPUSeconds:
          type: number
          description: Billable CPU-seconds after product-specific rules (for example
            Lakehouse). Omitted on partial metrics until the job finalizes.
        executorsCPUSeconds:
          type: object
          additionalProperties:
            type: number
          description: Per-worker executor CPU-seconds, keyed by worker or executor
            identifier.
        totalCPUSeconds:
          type: number
          description: Total CPU-seconds for the job (executors plus coordinator), prior
            to billing adjustments.
        totalExecCPUSeconds:
          type: number
          description: Sum of executor CPU-seconds across all workers for this job.
      required:
        - executorsCPUSeconds
        - totalCPUSeconds
        - totalExecCPUSeconds
    DatatypeOverrides:
      type: object
      properties:
        breakerRulesets:
          type: array
          items:
            $ref: "#/components/schemas/EventBreakerRuleset"
        disableBreakers:
          type: boolean
      required:
        - disableBreakers
    SearchErrorCategory:
      type: string
      enum:
        - budget_error
        - compute_provisioning_error
        - external_service_error
        - fleet_update_error
        - heartbeat_error
        - internal_error
        - internal_service_error
        - interrupted_error
        - kusto_error
        - limits_error
        - query_cancelled_error
        - query_execution_error
        - queue_error
        - resource_limit_error
        - start_error
        - synthetic_error
        - timeout_error
        - unknown_error
        - unsupported
        - user_config_error
        - user_query_error
      x-speakeasy-unknown-values: allow
    SearchJobErrorConfig:
      type: object
      properties:
        category:
          $ref: "#/components/schemas/SearchErrorCategory"
        message:
          type: string
      required:
        - message
    SearchJobErrorStateConfig:
      type: object
      properties:
        coordinated:
          type: boolean
        errors:
          type: array
          items:
            $ref: "#/components/schemas/SearchJobErrorConfig"
      required:
        - coordinated
        - errors
    ComputeTypeCounts:
      type: object
      properties:
        v1:
          type: number
        v2:
          type: number
        lakehouse:
          type: number
        local:
          type: number
    SearchJobMetadata:
      type: object
      properties:
        arguments:
          type: object
          additionalProperties:
            type: array
            items:
              type: object
              additionalProperties:
                type: string
        cloudProvider:
          type: string
        computeTypes:
          $ref: "#/components/schemas/ComputeTypeCounts"
        datasets:
          type: object
          additionalProperties:
            type: number
        functions:
          type: object
          additionalProperties:
            type: number
        operators:
          type: object
          additionalProperties:
            type: number
        providerTypes:
          type: object
          additionalProperties:
            type: number
        providers:
          type: object
          additionalProperties:
            type: number
    SearchParameterValue:
      type:
        - string
        - number
        - boolean
    SearchParameterType:
      type: string
      enum:
        - boolean
        - number
        - string
      x-speakeasy-unknown-values: allow
    SearchParameter:
      type: object
      properties:
        defaultValue:
          $ref: "#/components/schemas/SearchParameterValue"
        name:
          type: string
        type:
          $ref: "#/components/schemas/SearchParameterType"
      required:
        - name
        - type
    SearchParameters:
      type: object
      additionalProperties:
        type:
          - string
          - number
          - boolean
    SearchComputeType:
      type: string
      enum:
        - v1
        - v2
        - lakehouse
        - local
      x-speakeasy-unknown-values: allow
    CacheStatusByDatasetId:
      type: object
      additionalProperties:
        oneOf:
          - $ref: "#/components/schemas/CacheStatusByDatasetIdUsedCacheTrueWithComputeTypeC\
              onstraint"
          - $ref: "#/components/schemas/CacheStatusByDatasetIdUsedCacheFalseWithCacheStatus\
              Constraint"
    StageId:
      type: string
    StageDependencyType:
      type: string
      enum:
        - stage
        - stage-scalar
      x-speakeasy-unknown-values: allow
    StageDependency:
      type: object
      properties:
        dependentFields:
          type: array
          items:
            type: string
        id:
          $ref: "#/components/schemas/StageId"
        type:
          $ref: "#/components/schemas/StageDependencyType"
      required:
        - id
        - type
    JobExecutionWarning:
      type: object
      properties:
        text:
          type: string
        type:
          type: string
      required:
        - type
    LogicalPlanNodeType:
      type: string
      enum:
        - aggregate
        - dedup
        - distinct
        - extract
        - filter
        - limit
        - mv-expand
        - mv-pull
        - noop
        - pivot
        - project
        - sort
      x-speakeasy-unknown-values: allow
    LogicalPlan:
      type: object
      additionalProperties:
        type: array
        items:
          type: object
          properties:
            isPreviewableOperation:
              type: boolean
            type:
              $ref: "#/components/schemas/LogicalPlanNodeType"
          required:
            - type
    ColumnPath:
      type: array
      items:
        type: string
    SearchTerm:
      type: object
      properties:
        isCaseSensitive:
          type: boolean
        term:
          type: string
      required:
        - isCaseSensitive
        - term
    SortByField:
      type: object
      properties:
        direction:
          type: string
          enum:
            - ascending
            - descending
          x-speakeasy-unknown-values: allow
        fieldName:
          type: string
        nullPosition:
          type: string
          enum:
            - nullsFirst
            - nullsLast
          x-speakeasy-unknown-values: allow
      required:
        - direction
        - fieldName
        - nullPosition
    SearchConfig:
      type: object
      properties:
        canComputeMetadataDistributively:
          type: boolean
        datasets:
          type: array
          items:
            type: string
        hasSendOperator:
          type: boolean
        logicalPlans:
          type: object
          properties:
            Combined:
              $ref: "#/components/schemas/LogicalPlan"
            Coordinated:
              $ref: "#/components/schemas/LogicalPlan"
            Federated:
              $ref: "#/components/schemas/LogicalPlan"
        orderedFieldNames:
          type: array
          items:
            type: string
        pipelines:
          type: object
          properties:
            Combined:
              $ref: "#/components/schemas/Pipeline"
            Coordinated:
              $ref: "#/components/schemas/Pipeline"
            Federated:
              $ref: "#/components/schemas/Pipeline"
        referencedColumnPaths:
          type: array
          items:
            $ref: "#/components/schemas/ColumnPath"
        searchTerms:
          type: array
          items:
            $ref: "#/components/schemas/SearchTerm"
        sortFields:
          type: array
          items:
            $ref: "#/components/schemas/SortByField"
        useFormattedVisualization:
          type: boolean
      required:
        - datasets
        - hasSendOperator
        - logicalPlans
        - orderedFieldNames
        - pipelines
        - searchTerms
        - useFormattedVisualization
    SearchJobStageConfig:
      type: object
      properties:
        cacheStatusByDatasetId:
          $ref: "#/components/schemas/CacheStatusByDatasetId"
        dependencies:
          type: array
          items:
            $ref: "#/components/schemas/StageDependency"
        earliest:
          type:
            - string
            - number
        executionWarnings:
          type: array
          items:
            $ref: "#/components/schemas/JobExecutionWarning"
        filter:
          type: string
        id:
          type: string
        latest:
          type:
            - string
            - number
        resolvedDatasetIds:
          type: array
          items:
            type: string
        searchConfig:
          $ref: "#/components/schemas/SearchConfig"
        searchVersionByDatasetId:
          type: object
          additionalProperties:
            type: string
            enum:
              - v1
              - v2
            x-speakeasy-unknown-values: allow
        status:
          type: string
          enum:
            - failed
            - new
            - running
            - completed
            - queued
            - canceled
          x-speakeasy-unknown-values: allow
        subQueryText:
          type: string
      required:
        - dependencies
        - filter
        - id
        - resolvedDatasetIds
        - searchConfig
        - status
        - subQueryText
    SearchAuditLaunch:
      type: object
      properties:
        coordReadyToRunSec:
          type: number
        coordRunToFirstStageSec:
          type: number
        coordRunToMarkStartedSec:
          type: number
        dequeuedToMarkStartedSec:
          type: number
        jobCreatedToDequeuedSec:
          type: number
        jobCreatedToPreSpawnSec:
          type: number
        preSpawnToCoordReadySec:
          type: number
        totalSec:
          type: number
      required:
        - coordReadyToRunSec
        - coordRunToFirstStageSec
        - coordRunToMarkStartedSec
        - dequeuedToMarkStartedSec
        - jobCreatedToDequeuedSec
        - jobCreatedToPreSpawnSec
        - preSpawnToCoordReadySec
        - totalSec
    SearchAuditMetrics:
      type: object
      properties:
        bytesIn:
          type: number
        bytesOut:
          type: number
        coordCpuPerc:
          type: number
        eventsIn:
          type: number
        eventsOut:
          type: number
        instanceTypeCodes:
          type: array
          items:
            type: string
        objects:
          type: object
          properties:
            discovered:
              type: number
            scanned:
              type: number
            skipped:
              type: number
          required:
            - discovered
            - scanned
            - skipped
        processFromWarmPool:
          type: boolean
        tasks:
          type: object
          properties:
            largeFileTaskCount:
              type: number
            standardTaskCount:
              type: number
          required:
            - largeFileTaskCount
            - standardTaskCount
        time:
          type: object
          properties:
            launch:
              $ref: "#/components/schemas/SearchAuditLaunch"
            queuedSec:
              type: number
            runningSec:
              type: number
            taskCompletionTotalSec:
              type: number
            taskReceivingTotalSec:
              type: number
          required:
            - launch
            - queuedSec
            - runningSec
            - taskCompletionTotalSec
            - taskReceivingTotalSec
      required:
        - bytesIn
        - bytesOut
        - coordCpuPerc
        - eventsIn
        - eventsOut
        - objects
        - processFromWarmPool
        - time
    JobUserType:
      type: string
      enum:
        - apiCredential
        - user
      x-speakeasy-unknown-values: allow
    JobUserDetails:
      type: object
      properties:
        apiCredential:
          type: object
          properties:
            clientId:
              type: string
            createdBy:
              type: string
            name:
              type: string
          required:
            - clientId
            - name
        displayUsername:
          type: string
        email:
          type: string
        roles:
          type: array
          items:
            type: string
        ssoGroups:
          type: array
          items:
            type: string
        type:
          $ref: "#/components/schemas/JobUserType"
        username:
          type: string
      required:
        - displayUsername
        - type
        - username
    SearchJob:
      type: object
      properties:
        accelerated:
          type: boolean
          description: If <code>true</code>, one or more Datasets in the query used
            acceleration metadata.
        aliasOfOriginalJobId:
          type: string
          description: For deduplicated or aliased executions, the id of the canonical job
            this run points to.
        chartConfig:
          type: object
          properties:
            applyThreshold:
              type: boolean
              description: If <code>true</code>, apply color thresholds to the chart values.
            axis:
              $ref: "#/components/schemas/AxisTypeChartElementConfig"
            color:
              type: string
              description: CSS color value for single-value counters.
              example: "#5470C6"
            colorPalette:
              type: integer
              description: Index of the color palette to apply to the chart.
            colorPaletteReversed:
              type: boolean
              description: If <code>true</code>, reverse the color palette order.
            colorThresholds:
              $ref: "#/components/schemas/ColorThresholdsTypeChartElementConfig"
            customData:
              $ref: "#/components/schemas/CustomDataTypeChartElementConfig"
            decimals:
              type: integer
              description: Number of decimal places for numeric display.
            label:
              type: string
              description: Display label for single-value counters.
            legend:
              $ref: "#/components/schemas/LegendTypeChartElementConfig"
            mapDetails:
              $ref: "#/components/schemas/MapDetailsTypeChartElementConfig"
            onClickAction:
              $ref: "#/components/schemas/OnClickAction"
              description: Action to perform when a user clicks on the chart.
            prefix:
              type: string
              description: String prepended to the displayed value.
            separator:
              type: boolean
              description: If <code>true</code>, apply thousands separators to numeric values.
            series:
              type: array
              items:
                $ref: "#/components/schemas/ChartSeries"
              description: Explicit series definitions with individual styling.
            seriesInfo:
              type: object
              additionalProperties:
                $ref: "#/components/schemas/ChartType"
              description: Map of series names to display overrides (name, color, type, area
                style).
            shouldApplyUserChartSettings:
              type: boolean
              description: If <code>true</code>, apply user-level chart display preferences.
            style:
              type: boolean
              description: If <code>true</code>, apply custom styling to the chart.
            suffix:
              type: string
              description: String appended to the displayed value.
            type:
              $ref: "#/components/schemas/ChartType"
              description: Default chart type for all series.
            xAxis:
              $ref: "#/components/schemas/XAxisTypeChartElementConfig"
            yAxis:
              $ref: "#/components/schemas/YAxisTypeChartElementConfig"
          description: Visualization settings for timechart or other chart views tied to
            this job.
        compatibilityChecks:
          type: object
          properties:
            datatypes:
              type: boolean
              description: If <code>true</code>, some Worker/Edge Nodes lack datatype support
                required by this query.
            stageIds:
              type: array
              items:
                type: string
              description: Stage identifiers that may hit compatibility limitations on older
                workers.
          description: Hints about worker-version mismatches that may affect execution
            (datatypes support, affected stages).
        completionInfo:
          type: string
          description: Human-readable completion detail (for example cancellation due to
            service limits).
        context:
          type: string
          description: Pack or configuration context id when the job runs inside a Pack
            scope.
        correlationId:
          type: string
          description: Correlation token (Saved Query id, session id, etc.) linking this
            job to a broader workflow.
        cpuMetrics:
          $ref: "#/components/schemas/CPUTimeMetric"
          description: Aggregated CPU-time metrics embedded on the job record when
            available.
        datatypeOverrides:
          $ref: "#/components/schemas/DatatypeOverrides"
          description: Datatype and breaker overrides applied when is
            <code>datatypePreview</code>.
        disableNotifications:
          type: boolean
          description: If <code>true</code>, suppress notifications typically triggered by
            this job.
        displayUsername:
          type: string
          description: Human-readable label for the job owner, shown in the UI (distinct
            from ).
        earliest:
          type:
            - string
            - number
          description: Lower bound of the search time window; relative string or Unix
            seconds, aligned with <code>earliest</code>.
          examples:
            - -24h
            - "1715000000"
        earliestEpoch:
          type: integer
          description: Timestamp (in Unix time) for the start of the query time range,
            inclusive (milliseconds).
        errorStateConfig:
          $ref: "#/components/schemas/SearchJobErrorStateConfig"
          description: Structured failure information when is <code>failed</code>;
            server-managed, not writable via update APIs.
        group:
          type: string
          description: Worker Group or Search Group ID whose configuration and limits apply.
        id:
          type: string
          description: Unique identifier for the search job.
        isPrivate:
          type: boolean
          description: If <code>true</code>, restrict results to the owner. If
            <code>false</code>, apply broader group access per product defaults
            (see API create schema for defaulting).
        latest:
          type:
            - string
            - number
          description: Upper bound of the search time window; relative string or Unix
            seconds, aligned with <code>latest</code>.
        latestEpoch:
          type: integer
          description: Timestamp (in Unix time) for the end of the query time range,
            exclusive (milliseconds).
        metadata:
          $ref: "#/components/schemas/SearchJobMetadata"
          description: Additional job statistics surfaced for auditing or support.
        notebookId:
          type: string
          description: Notebook identifier when the job was started from Search Notebooks.
        numEventsAfter:
          type: integer
          description: Events to retrieve after in contextual-event mode. On create, must
            be non-negative (<code>minimum</code> <code>0</code> in ).
        numEventsBefore:
          type: integer
          description: Events to retrieve before in contextual-event mode. On create, must
            be non-negative (<code>minimum</code> <code>0</code> in ).
        pendingComputeNodeStatuses:
          $ref: "#/components/schemas/PendingComputeNodeStatusesTypeSearchJob"
        query:
          type: string
          description: Kusto query text as submitted before macro expansion and
            server-side normalization.
        queryWithMacrosResolved:
          type: string
          description: Query text after preprocessing with macros fully expanded for
            display or debugging.
        sampleRate:
          type: number
          description: Early-pipeline sampling probability. On create, inclusive range
            <code>0</code>–<code>1</code> per (<code>minimum</code>
            <code>0</code>, <code>maximum</code> <code>1</code>).
        savedQueryName:
          type: string
          description: Display name of the Saved Query linked via ; populated when
            requested from the jobs API.
        searchParameterDeclarations:
          type: array
          items:
            $ref: "#/components/schemas/SearchParameter"
          description: Declared search parameters extracted from the query (names, types,
            defaults).
        searchParameterValues:
          $ref: "#/components/schemas/SearchParameters"
          description: Concrete values for declared search parameters; required when is
            non-empty.
        setOptions:
          type: object
          additionalProperties:
            type:
              - string
              - number
          description: Map of <code>SET</code> option names to string or numeric values
            controlling query execution.
        stages:
          type: array
          items:
            $ref: "#/components/schemas/SearchJobStageConfig"
          description: Planner-generated pipeline stages for this job (at least one per
            query).
        status:
          $ref: "#/components/schemas/StatusOptionsSearchJob"
        tableConfig:
          $ref: "#/components/schemas/TableViewSettings"
          description: Tabular result view settings (columns, formatting) for this job.
        targetEventTime:
          type: integer
          description: Anchor event time (Unix epoch milliseconds) for contextual
            before/after windows; use together with and .
        timeCompleted:
          type: integer
          description: Time the job reached a terminal state, in Unix epoch milliseconds,
            when known.
        timeCreated:
          type: integer
          description: Job creation time in Unix epoch milliseconds.
        timeStarted:
          type: integer
          description: Time execution began, in Unix epoch milliseconds, when known.
        timeToFirstByte:
          type: number
          description: Seconds from job start until the first telemetry event that reports
            data read or delivered (see coordinator metrics for the same field);
            fractional seconds.
        timezone:
          type: string
          description: IANA timezone for interpreting relative bounds and timestamps.
          examples:
            - America/New_York
            - UTC
        totalBytesScanned:
          type: integer
          description: Total bytes scanned across inputs when the job completes and
            metrics finalize.
        totalEventCount:
          type: integer
          description: Total result events for a completed job; may be omitted unless
            requested from the jobs API (for example query history).
        type:
          type: string
          enum:
            - agentic
            - command
            - dashboard
            - datatypePreview
            - notebook
            - scheduled
            - standard
            - systemInsights
          description: Discriminator for specialized job modes (for example datatype
            preview); omit for standard interactive searches.
          x-speakeasy-unknown-values: allow
        usageGroupId:
          type: string
          description: Usage Group whose service-limit rules apply to this job.
        usageMetrics:
          $ref: "#/components/schemas/SearchAuditMetrics"
          description: Audit-oriented usage counters persisted when the job finishes.
        user:
          type: string
          description: Authenticated principal identifier used for RBAC and auditing.
        userDetails:
          $ref: "#/components/schemas/JobUserDetails"
          description: Snapshot of token claims at creation (username, roles, API
            credential metadata).
      required:
        - displayUsername
        - group
        - id
        - query
        - status
        - timeCreated
        - user
    CountedSearchJob:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SearchJob"
    CreateSearchJobSchema:
      type: object
      required:
        - query
      properties:
        query:
          type: string
          title: Query
          description: Query to execute
        earliest:
          type:
            - number
            - string
          title: Earliest time for the query
          description: Earliest time in the query time range
        latest:
          type:
            - number
            - string
          title: Query end time
          description: Latest time in the query time range
        numEventsBefore:
          type: number
          minimum: 0
          title: Num events before the current one to query
          description: Start of the query time range
        numEventsAfter:
          minimum: 0
          type: number
          title: Num events after the current one to query
          description: Start of the query time range
        targetEventTime:
          type: number
          title: The target event time. If set, numEventsBefore and numEventsAfter need to
            also be set
          description: Start of the query time range
        sampleRate:
          type: number
          title: Sampling Rate
          description: Number between 0 and 1 that represents a sampling rate to pick
            events for search.
          minimum: 0
          maximum: 1
        timezone:
          type: string
          title: Timezone
          description: IANA timezone identifier (e.g., America/New_York, UTC) to use for
            the search job.
        isPrivate:
          type: boolean
          title: Results Access
          description: Whether the results of the job are accessible to all members or
            only to the owner.
        setOptions:
          type: object
          title: Execution Options
          description: Query execution options.
        expectedOutputType:
          type: string
          title: Expected output type
          description: Output type expected from the System Insights query
    SearchJobType:
      type: string
      enum:
        - standard
        - datatypePreview
        - scheduled
        - dashboard
        - command
        - notebook
        - systemInsights
        - agentic
      x-speakeasy-unknown-values: allow
    UpdateSearchJobSchema:
      type: object
      properties:
        status:
          title: Status
          description: The new status for the job
          enum:
            - completed
            - canceled
          x-speakeasy-unknown-values: allow
        isPrivate:
          type: boolean
          title: Private results
          description: Whether the results of the job are accessible to all users or only
            to the owner.
    CountedAllocateResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AllocateResult"
    AllocatedInstanceDetails:
      type: object
      properties:
        executorVersion:
          type: string
          description: Cribl Search executor version running on this instance.
        instanceType:
          type: string
          description: Cloud instance type or SKU for the allocated Node.
        numCpus:
          type: integer
          description: Number of CPU cores on the allocated instance, when the provider
            reports it.
        totalAllocatedTasks:
          type: integer
          description: Tasks assigned to this node across jobs when the allocation was
            recorded; values above one suggest a shared Worker.
    DatasetProviderTypeDimValue:
      type: string
      enum:
        - s3
        - azure_blob
        - lake
        - other
        - mixed
      x-speakeasy-unknown-values: allow
    DeuxTask:
      type: object
      properties:
        cloudProviderId:
          type: string
          description: Cloud vendor <code>id</code> for the executor.
        datasetProviderType:
          $ref: "#/components/schemas/DatasetProviderTypeDimValue"
          description: Dataset provider mix for metrics dimensions.
        pathsByDatasetId:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          description: Map from dataset ID to storage paths read by this task.
        region:
          type: string
          description: Region where compute runs.
        searchJobId:
          type: string
          description: Search job that this task belongs to.
        stageId:
          type: string
          description: Stage within the search job this task targets.
      required:
        - cloudProviderId
        - pathsByDatasetId
        - region
        - searchJobId
        - stageId
    DeuxAllocateResponse:
      type: object
      properties:
        instanceDetails:
          $ref: "#/components/schemas/AllocatedInstanceDetails"
          description: Optional capacity and version metadata for the allocated instance.
        instanceId:
          type: string
          description: Compute instance identifier for the node that runs this task.
        task:
          $ref: "#/components/schemas/DeuxTask"
          description: Search task payload (Datasets, paths, job and stage IDs, region,
            cloud).
      required:
        - instanceId
        - task
    AllocateResult:
      type: object
      properties:
        deuxResponse:
          $ref: "#/components/schemas/DeuxAllocateResponse"
          description: Compute-specific allocation payload for this search task.
        error:
          type: object
          required:
            - name
            - message
          properties:
            name:
              type: string
            message:
              type: string
            stack:
              type: string
          description: Present on failure; standard JavaScript error (message, name,
            stack, and so on).
        executorId:
          type: string
          description: Executor identifier when an executor was started or reserved.
        pid:
          type: string
          description: Host process identifier for the executor, when reported by the
            provider.
        provider:
          type: string
          description: Compute provider key that produced this result.
        success:
          type: boolean
          description: If true, the allocation attempt succeeded.
      required:
        - provider
        - success
    SearchJobSettings:
      type: object
      properties:
        reaperKeepUntil:
          type: integer
          description: Timestamp (in Unix time) until which the job must be retained
            (milliseconds). Extends the default retention period only; never
            shortens it.
    StatusResponse:
      type: object
      properties:
        bytesIn:
          type: integer
          description: Number of bytes that were scanned while executing the query.
        bytesSkipped:
          type: integer
          description: Number of bytes that were skipped through metadata manifest
            optimizations.
        cacheStatusesByStageId:
          type: object
          additionalProperties:
            type: object
            additionalProperties:
              oneOf:
                - $ref: "#/components/schemas/CacheStatusByDatasetIdUsedCacheTrueWithComputeTypeC\
                    onstraint"
                - $ref: "#/components/schemas/CacheStatusByDatasetIdUsedCacheFalseWithCacheStatus\
                    Constraint"
          description: Per-stage map of per-dataset cache status (hit, miss, error,
            intended compute tier).
        eventsFound:
          type: integer
          description: Number of events that matched the query. May be omitted except for
            some Lakehouse searches.
        eventsIn:
          type: integer
          description: Number of events that were scanned while executing the query.
        eventsSkipped:
          type: integer
          description: Number of events that were skipped through metadata manifest
            optimizations.
        objectsFound:
          type: integer
          description: Number of objects that were discovered for the search to read.
        objectsSearched:
          type: integer
          description: Number of objects that have been fully searched so far.
        objectsSkipped:
          type: integer
          description: Number of objects that were skipped, including manifest-based and
            executor-level skips.
        pendingComputeNodeStatuses:
          oneOf:
            - $ref: "#/components/schemas/PendingComputeNodeStatusesTypeSearchJob"
            - type: "null"
          description: Pending compute node assignment status for the job.
        stageDetails:
          type: array
          items:
            type: object
            properties:
              cacheStatusByDatasetId:
                $ref: "#/components/schemas/CacheStatusByDatasetId"
                description: Cache resolution status for each Dataset in the stage.
              stageId:
                type: string
                description: Identifier for the pipeline stage.
              status:
                type: string
                enum:
                  - canceled
                  - completed
                  - failed
                  - new
                  - queued
                  - running
                description: Lifecycle status of the stage.
                x-speakeasy-unknown-values: allow
            required:
              - cacheStatusByDatasetId
              - stageId
              - status
          description: Progress and cache resolution details for each pipeline stage.
        status:
          type: string
          enum:
            - canceled
            - completed
            - failed
            - new
            - queued
            - running
          description: Current lifecycle status of the search job.
          x-speakeasy-unknown-values: allow
        timeCompleted:
          type: integer
          description: Timestamp (in Unix time) for when the job finished or was cancelled
            (milliseconds).
        timeCreated:
          type: integer
          description: Timestamp (in Unix time) for when the job was created (milliseconds).
        timeNow:
          type: integer
          description: Current server timestamp (in Unix time) for elapsed-time
            calculations (milliseconds).
        timeStarted:
          type: integer
          description: Timestamp (in Unix time) for when the job began executing
            (milliseconds).
      required:
        - pendingComputeNodeStatuses
        - status
        - timeCreated
    Bucket:
      type: object
      properties:
        duration:
          type: integer
          description: Histogram bucket width on the time axis.
        earliest:
          type: integer
          description: Inclusive lower bound of this bucket.
        eventCount:
          type: integer
          description: Event count aggregated into this time bucket.
      required:
        - duration
        - earliest
        - eventCount
    SearchTimeline:
      type: object
      properties:
        buckets:
          type: array
          items:
            $ref: "#/components/schemas/Bucket"
          description: Event counts per time bucket for charting.
        totalEventCount:
          type: integer
          description: Total number of events across all buckets.
      required:
        - buckets
        - totalEventCount
    TopValue:
      type: object
      properties:
        count:
          type: number
          description: Number of occurrences of the value within the field summary sample.
        value:
          type: string
          description: Field value as a string.
      required:
        - count
        - value
    FieldType:
      type: string
      enum:
        - array
        - boolean
        - number
        - object
        - string
        - timestamp
      x-speakeasy-unknown-values: allow
    Field:
      type: object
      properties:
        buckets:
          type: array
          items:
            $ref: "#/components/schemas/Bucket"
          description: "Histogram buckets for the field: event counts and time span per
            bucket for visualization."
        count:
          type: integer
          description: Number of non-null values that were counted for the field.
        countDistinct:
          type: integer
          description: Approximate number of distinct values that were observed for the
            field.
        countNull:
          type: integer
          description: Number of null or missing values for the field.
        max:
          type:
            - string
            - number
          description: Maximum value that was observed for the field. For time fields, the
            value is in epoch seconds.
        mean:
          type: number
          description: Mean of numeric field values, as a floating-point number.
        min:
          type:
            - string
            - number
          description: Minimum value that was observed for the field. For time fields, the
            value is in epoch seconds.
        name:
          type: string
          description: Logical field identifier.
        stdev:
          type: number
          description: Sample standard deviation of numeric field values, as a
            floating-point number.
        topValues:
          type: array
          items:
            $ref: "#/components/schemas/TopValue"
          description: Most frequent values and their approximate counts for the field.
        type:
          $ref: "#/components/schemas/FieldType"
          description: Type of the field.
      required:
        - buckets
        - count
        - countDistinct
        - countNull
        - name
        - topValues
        - type
    FieldSummaries:
      type: object
      properties:
        fields:
          type: array
          items:
            $ref: "#/components/schemas/Field"
          description: Field statistics and top values for each field.
        partial:
          type: boolean
          description: If <code>true</code>, one or more fields were omitted due to field
            summary limits.
        totalEventCount:
          type: integer
          description: Total number of events that were considered for the summary.
      required:
        - fields
        - totalEventCount
    MonitorConfigProfile:
      type: object
      properties:
        configIds:
          type: array
          items:
            type: string
        description:
          type: string
        id:
          type: string
        name:
          type: string
        parentId:
          type: string
      required:
        - configIds
        - id
        - name
    CountedMonitorConfigProfile:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/MonitorConfigProfile"
    AttachConfigRequest:
      type: object
      properties:
        configId:
          type: string
      required:
        - configId
    LinkProfileRequest:
      type: object
      properties:
        parentId:
          type: string
      required:
        - parentId
    MonitorQueryLabelFilterOperator:
      type: string
      enum:
        - =
        - "!="
      x-speakeasy-unknown-values: allow
    MonitorQueryLabelFilter:
      type: object
      properties:
        label:
          type: string
        operator:
          $ref: "#/components/schemas/MonitorQueryLabelFilterOperator"
        value:
          type: string
      required:
        - label
        - operator
        - value
    ByWithoutClause:
      type: object
      properties:
        operator:
          type: string
          enum:
            - by
            - without
          x-speakeasy-unknown-values: allow
        parameters:
          type: array
          items:
            type: string
      required:
        - operator
        - parameters
    MonitorQueryOperation:
      type: object
      properties:
        byWithoutClause:
          $ref: "#/components/schemas/ByWithoutClause"
        operation:
          type: string
          enum:
            - count
            - sum
            - min
            - max
            - avg
          x-speakeasy-unknown-values: allow
      required:
        - operation
    MonitorQuery:
      type: object
      properties:
        labelFilters:
          type: array
          items:
            $ref: "#/components/schemas/MonitorQueryLabelFilter"
        metricName:
          type: string
        operation:
          $ref: "#/components/schemas/MonitorQueryOperation"
        timeRange:
          type: string
      required:
        - labelFilters
        - metricName
        - operation
        - timeRange
      title: MonitorQuery
    Condition:
      $ref: "#/components/schemas/Function"
    LabelCondition:
      type: object
      properties:
        condition:
          $ref: "#/components/schemas/Condition"
        enabled:
          type: boolean
          deprecated: true
        labels:
          type: object
          additionalProperties:
            type: string
      required:
        - condition
        - enabled
        - labels
    Rule:
      type: object
      properties:
        conditions:
          type: array
          items:
            $ref: "#/components/schemas/LabelCondition"
        excludedTags:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          example: |-
            { "team": ["sre", "devops"], "env": ["dev"] }
            excludes if (team="sre" OR team="devops") OR env="dev"
        includedTags:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          example: |-
            { "team": ["sre", "devops"], "env": ["prod"] }
            matches if (team="sre" OR team="devops") AND env="prod"
        name:
          type: string
        showOnChart:
          type: boolean
      required:
        - conditions
        - excludedTags
        - includedTags
        - name
        - showOnChart
    MonitorConf:
      type: object
      properties:
        description:
          type: string
        enabled:
          type: boolean
        firing_after:
          type: number
        id:
          type: string
        isDefault:
          type: boolean
        name:
          type: string
        notification_policies:
          type: array
          items:
            type: string
        notifications_enabled:
          type: boolean
        ok_after:
          type: number
        params:
          type: object
          additionalProperties:
            type:
              - string
              - number
              - boolean
        product:
          type: string
        query:
          oneOf:
            - type: string
            - $ref: "#/components/schemas/MonitorQuery"
        rules:
          type: array
          items:
            $ref: "#/components/schemas/Rule"
        schedule_interval_seconds:
          type: number
        silences:
          type: array
          items:
            type: string
        sqlOverride:
          type: object
          properties:
            instant:
              type: string
            range:
              type: string
          required:
            - instant
            - range
      required:
        - enabled
        - firing_after
        - id
        - name
        - ok_after
        - params
        - product
        - query
        - rules
        - schedule_interval_seconds
    CountedMonitorConf:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/MonitorConf"
    ProfileRef:
      type: object
      properties:
        fingerprint:
          type: string
        id:
          type: string
      required:
        - fingerprint
        - id
    QueryExpression:
      type: object
      properties:
        label:
          type: string
        left:
          type: string
        operation:
          type: object
          additionalProperties: true
        right:
          type: string
      required:
        - label
        - left
        - operation
    FiringCondition:
      type: object
      properties:
        clear_delay:
          type: number
        fire_delay:
          type: number
      required:
        - clear_delay
        - fire_delay
      title: FiringCondition
    SharedConfigRef:
      type: object
      properties:
        fingerprint:
          type: string
        id:
          type: string
      required:
        - fingerprint
        - id
    Inheritable:
      type: object
      properties:
        $configRefs:
          type: array
          items:
            $ref: "#/components/schemas/SharedConfigRef"
      required:
        - $configRefs
      title: Inheritable
    InheritableIFiringCondition:
      oneOf:
        - $ref: "#/components/schemas/FiringCondition"
        - $ref: "#/components/schemas/Inheritable"
    AnomalyThresholdDirection:
      type: string
      enum:
        - above
        - below
        - either
      x-speakeasy-unknown-values: allow
    EvaluationWindowUnit:
      type: string
      enum:
        - s
        - m
        - h
        - d
      x-speakeasy-unknown-values: allow
    AnomalyConfig:
      type: object
      properties:
        minimumSamples:
          type: number
        sensitivity:
          type: number
        thresholdDirection:
          $ref: "#/components/schemas/AnomalyThresholdDirection"
        trainingWindow:
          type: object
          properties:
            unit:
              $ref: "#/components/schemas/EvaluationWindowUnit"
            value:
              type: number
          required:
            - unit
            - value
      title: AnomalyConfig
    TagFilter:
      type: object
      additionalProperties:
        type: array
        items:
          type: string
    ThresholdOperator:
      type: string
      enum:
        - gt
        - lt
        - gte
        - lte
        - eq
        - neq
      x-speakeasy-unknown-values: allow
    Severity:
      type: string
      enum:
        - critical
        - warning
        - info
      x-speakeasy-unknown-values: allow
    FiringRuleThreshold:
      type: object
      properties:
        excludedTags:
          type: array
          items:
            $ref: "#/components/schemas/TagFilter"
        includedTags:
          type: array
          items:
            $ref: "#/components/schemas/TagFilter"
        limit:
          type: number
        operator:
          $ref: "#/components/schemas/ThresholdOperator"
        severity:
          $ref: "#/components/schemas/Severity"
        timesTriggered:
          type: number
      required:
        - excludedTags
        - includedTags
        - limit
        - severity
    FiringRule:
      type: object
      properties:
        config:
          oneOf:
            - $ref: "#/components/schemas/AnomalyConfig"
            - type: "null"
        label:
          type: string
        threshold:
          type: array
          items:
            $ref: "#/components/schemas/FiringRuleThreshold"
      required:
        - config
        - label
        - threshold
      title: FiringRule
    InheritableIFiringRule:
      oneOf:
        - $ref: "#/components/schemas/FiringRule"
        - $ref: "#/components/schemas/Inheritable"
    AwsMetadata:
      type: object
      properties:
        hostname:
          type: string
        identity:
          type: object
          additionalProperties: true
        public_ipv4:
          type: string
        roles:
          type: array
          items:
            type: string
        security_groups:
          type: array
          items:
            type: string
        tags:
          type: object
          additionalProperties:
            type: string
        version:
          type: number
      required:
        - version
    AzureMetadata:
      type: object
      properties:
        hostname:
          type: string
        location:
          type: string
        name:
          type: string
        public_ipv4:
          type: string
        resourceGroupName:
          type: string
        subscriptionId:
          type: string
        tags:
          type: object
          additionalProperties:
            type: string
        vmId:
          type: string
        vmSize:
          type: string
        zone:
          type: string
    CriblMetadata:
      type: object
      properties:
        config_version:
          type: string
        group:
          type: string
        guid:
          type: string
        install_type:
          type: string
        mode:
          type: string
        tags:
          type: array
          items:
            type: string
        version:
          type: string
      required:
        - mode
        - version
    EnvMetadata:
      type: object
      additionalProperties:
        type: string
    NetworkInterfaceInfoIPv4:
      type: object
      properties:
        address:
          type: string
        cidr:
          type:
            - "null"
            - string
        family:
          type: string
          const: IPv4
        internal:
          type: boolean
        mac:
          type: string
        netmask:
          type: string
        scopeid:
          type: number
      required:
        - address
        - cidr
        - family
        - internal
        - mac
        - netmask
      title: NetworkInterfaceInfoIPv4
    NetworkInterfaceInfoIPv6:
      type: object
      properties:
        address:
          type: string
        cidr:
          type:
            - "null"
            - string
        family:
          type: string
          const: IPv6
        internal:
          type: boolean
        mac:
          type: string
        netmask:
          type: string
        scopeid:
          type: number
      required:
        - address
        - cidr
        - family
        - internal
        - mac
        - netmask
        - scopeid
      title: NetworkInterfaceInfoIPv6
    NetworkInterfaces:
      type: object
      additionalProperties:
        type: array
        items:
          oneOf:
            - $ref: "#/components/schemas/NetworkInterfaceInfoIPv4"
            - $ref: "#/components/schemas/NetworkInterfaceInfoIPv6"
    OsMetadata:
      type: object
      properties:
        arch:
          type: string
        cpu_count:
          type: number
        cpu_speed_mhz:
          type: number
        cpu_type:
          type: string
        gid:
          type: number
        homedir:
          type: string
        hostname:
          type: string
        interfaces:
          $ref: "#/components/schemas/NetworkInterfaces"
        machine_id:
          type: string
        memory:
          type: number
        os_id:
          type: string
        os_name:
          type: string
        os_version:
          type: string
        os_version_id:
          type: string
        platform:
          type: string
        release:
          type: string
        timezone:
          type: string
        timezone_offset:
          type: string
        uid:
          type: number
        username:
          type: string
      required:
        - arch
        - cpu_count
        - cpu_speed_mhz
        - cpu_type
        - gid
        - homedir
        - hostname
        - interfaces
        - machine_id
        - memory
        - os_id
        - os_name
        - os_version
        - os_version_id
        - platform
        - release
        - timezone
        - timezone_offset
        - uid
        - username
    KubeMetadata:
      type: object
      properties:
        cluster:
          type: object
          additionalProperties: true
        container:
          type: object
          additionalProperties: true
        namespace:
          type: string
        node:
          type: object
          additionalProperties: true
        pod:
          type: object
          additionalProperties: true
        source:
          type: string
      required:
        - namespace
        - source
    Metadata:
      type: object
      properties:
        aws:
          $ref: "#/components/schemas/AwsMetadata"
        azure:
          $ref: "#/components/schemas/AzureMetadata"
        cribl:
          $ref: "#/components/schemas/CriblMetadata"
        env:
          $ref: "#/components/schemas/EnvMetadata"
        hostOs:
          $ref: "#/components/schemas/OsMetadata"
        kube:
          $ref: "#/components/schemas/KubeMetadata"
        os:
          $ref: "#/components/schemas/OsMetadata"
        timestamp:
          type: number
      required:
        - timestamp
      title: Metadata
    InheritableIMetadata:
      oneOf:
        - $ref: "#/components/schemas/Metadata"
        - $ref: "#/components/schemas/Inheritable"
    NotificationType:
      type: string
      enum:
        - policy
        - target
      x-speakeasy-unknown-values: allow
    NotificationConfig:
      type: object
      properties:
        config:
          oneOf:
            - type: array
              items:
                type: object
            - type: array
              items:
                type: object
        enabled:
          type: boolean
        type:
          $ref: "#/components/schemas/NotificationType"
      required:
        - config
        - enabled
        - type
      title: NotificationConfig
    InheritableINotificationConfig:
      oneOf:
        - $ref: "#/components/schemas/NotificationConfig"
        - $ref: "#/components/schemas/Inheritable"
    ScalarValue:
      type: object
      properties:
        value:
          type: object
          additionalProperties: true
      required:
        - value
      title: ScalarValue
    InheritableIScalarValue:
      oneOf:
        - $ref: "#/components/schemas/ScalarValue"
        - $ref: "#/components/schemas/Inheritable"
    InheritableIMonitorQuery:
      oneOf:
        - $ref: "#/components/schemas/MonitorQuery"
        - $ref: "#/components/schemas/Inheritable"
    TemplateParameters:
      type: object
      additionalProperties: true
      title: TemplateParameters
    InheritableTemplateParameters:
      oneOf:
        - $ref: "#/components/schemas/TemplateParameters"
        - $ref: "#/components/schemas/Inheritable"
    MonitorType:
      type: string
      enum:
        - threshold
        - change
        - anomaly
        - forecast
        - logs
        - outlier
      x-speakeasy-unknown-values: allow
    SharedConfig:
      type: object
      properties:
        config:
          type: object
          properties:
            $profileRef:
              $ref: "#/components/schemas/ProfileRef"
            description:
              type: string
            enabled:
              type: boolean
            expr:
              type: array
              items:
                $ref: "#/components/schemas/QueryExpression"
            firingCondition:
              $ref: "#/components/schemas/InheritableIFiringCondition"
            firingRule:
              $ref: "#/components/schemas/InheritableIFiringRule"
            id:
              type: string
            metadata:
              $ref: "#/components/schemas/InheritableIMetadata"
            name:
              type: string
            notification:
              $ref: "#/components/schemas/InheritableINotificationConfig"
            priority:
              $ref: "#/components/schemas/InheritableIScalarValue"
            query:
              $ref: "#/components/schemas/InheritableIMonitorQuery"
            searchMode:
              type: string
              enum:
                - new
                - saved
              x-speakeasy-unknown-values: allow
            silence:
              type: array
              items:
                type: string
            team:
              $ref: "#/components/schemas/InheritableIScalarValue"
            templateParams:
              $ref: "#/components/schemas/InheritableTemplateParameters"
            type:
              $ref: "#/components/schemas/MonitorType"
            unit:
              type: string
        fingerprint:
          type: string
        id:
          type: string
        name:
          type: string
      required:
        - config
        - fingerprint
        - id
    CountedSharedConfig:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SharedConfig"
    CountedBannerMessage:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/BannerMessage"
    BannerMessage:
      type: object
      additionalProperties: false
      required:
        - type
        - message
        - theme
        - enabled
      properties:
        id:
          type: string
          title: Banner ID
        enabled:
          type: boolean
          title: Enable banner
          description: Show a banner on top of all pages
        type:
          enum:
            - custom
            - system
          type: string
          title: Banner type
          x-speakeasy-unknown-values: allow
        created:
          type: number
          title: Time
          description: Time created
        theme:
          type: string
          title: Background color
          pattern: ^((#?[0-9a-fA-F]{6})|(orange)|(yellow)|(green)|(blue)|(purple)|(magenta)|(red)){1}$
        invertFontColor:
          type: boolean
          title: Invert font color
        message:
          type: string
          title: Banner message
          maxLength: 100
          description: Enter a message to display to all your Organization's users, across
            all Cribl products. Limited to one line and 100 characters; will be
            truncated as needed.
        link:
          type: string
          title: Link URL
          description: Optionally, provide a URL to append to the message
          pattern: ^https?://
        linkDisplay:
          type: string
          title: Link display
          maxLength: 100
          description: Optionally, display your link with a short text label instead of
            the raw URL (100-character limit)
        customThemes:
          type: array
          items:
            type: string
    CountedCertificate:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Certificate"
    Certificate:
      type: object
      properties:
        ca:
          type: string
          description: Certificate Authority (CA) certificate in PEM format:<br/><br/>
            Base64-encoded data enclosed by <code>-----BEGIN
            CERTIFICATE-----</code> and <code>-----END CERTIFICATE-----</code>
            delimiters.<br/><br/> If you need to provide a chain, concatenate
            multiple CA certificates in a single JSON string, each beginning and
            ending with its own delimiters.
        caPath:
          type: string
          description: Path to the Certificate Authority (CA) certificate file.
        cert:
          type: string
          description: Certificate in PEM format:<br/><br/> Base64-encoded data enclosed
            by <code>-----BEGIN CERTIFICATE-----</code> and <code>-----END
            CERTIFICATE-----</code> delimiters.<br/><br/> If you need to provide
            a chain, concatenate multiple certificates in a single JSON string,
            each beginning and ending with its own delimiters.
        certExpiryDate:
          type: string
          description: Certificate expiration date and time as an ISO-8601 UTC string.
        certPath:
          type: string
          description: Path to the certificate file.
        description:
          type: string
          description: Brief description of the certificate.
        id:
          type: string
          description: Unique identifier for the certificate.
        passphrase:
          type: string
          description: If the private key is encrypted, the decryption passphrase.
        passphrasePath:
          type: string
          description: Path to the passphrase file.
        privKey:
          type: string
          description: Private key for the certificate in PEM format:<br/><br/>
            Base64-encoded data enclosed by the appropriate delimiters for the
            key type, such as <code>-----BEGIN RSA PRIVATE KEY-----</code> and
            <code>-----END RSA PRIVATE KEY-----</code>.<br/><br/> Responses do
            not include the <code>privKey</code> value.
        privKeyPath:
          type: string
          description: Path to the private key file.
      required:
        - cert
        - id
        - privKey
    CountedFeaturesEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/FeaturesEntry"
    FeaturesEntry:
      type: object
      additionalProperties: true
      properties:
        disabled:
          type: boolean
        id:
          type: string
      required:
        - disabled
        - id
    CountedGlobalSecret:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GlobalSecret"
    GlobalSecretPlaintextFields:
      type: object
      properties:
        apiKey:
          type: string
          description: "The unencrypted API key value for the private key in the secret
            store. Present when <code>secretType: keypair</code>."
        username:
          type: string
          description: "The username for the password in the secret store. Present when
            <code>secretType: credentials</code>."
      description: Non-sensitive secret fields stored in plaintext.
    SecretReference:
      type: object
      properties:
        contentSha:
          type: string
          description: SHA-256 hash of the global secret value.
        field:
          type: string
          description: "Field name to extract from the entry for the global secret in the
            secret store. When the store returns a structured object, the
            <code>field</code> specifies the key to read. For the Cribl-managed
            store, the <code>field</code> is automatically populated based on
            the secret type: <code>value</code> for text secrets,
            <code>password</code> for credentials secrets, and
            <code>secretKey</code> for keypair secrets."
          example: client_secret
        secretId:
          type: string
          description: Identifier or path of the global secret entry in the secret store.
            For the Cribl-managed secret store, the <code>secretId</code> is
            automatically generated and matches the <code>id</code> of the
            global secret. For external secret stores, the <code>secretId</code>
            is the path to the secret in the external provider.
          example: vault/prod/github-app
      required:
        - secretId
      description: Reference to a sensitive value backed by a secret store.
    GlobalSecretReferences:
      type: object
      properties:
        password:
          $ref: "#/components/schemas/SecretReference"
          description: "Reference to the password value in the secret store. Present when
            <code>secretType: credentials</code>. Provide the username in
            <code>plaintextFields.username</code>. For external stores, use when
            creating or updating a global secret to reference the password in
            the external provider. For the Cribl-managed store, use
            <code>secretValues.password</code> instead when creating or updating
            a global secret. The Cribl-managed store automatically generates a
            <code>secretReferences.password</code> for the password to return in
            responses."
        secretKey:
          $ref: "#/components/schemas/SecretReference"
          description: "Reference to the private key value in the secret store. Present
            when <code>secretType: keypair</code>. Provide the API key in
            <code>plaintextFields.apiKey</code>. For external stores, use when
            creating or updating a global secret to reference the private key
            value in the external provider. For the Cribl-managed store, use
            <code>secretValues.secretKey</code> instead when creating or
            updating a global secret. The Cribl-managed store automatically
            generates a <code>secretReferences.secretKey</code> for the private
            key value to return in responses."
        value:
          $ref: "#/components/schemas/SecretReference"
          description: "Reference to the secret text value in the secret store. Present
            when <code>secretType: text</code>. For external stores, use when
            creating or updating a global secret to reference the secret text
            value in the external provider. For the Cribl-managed store, use
            <code>secretValues.value</code> instead when creating or updating a
            global secret. The Cribl-managed store automatically generates a
            <code>secretReferences.value</code> for the secret text value to
            return in responses."
      description: References to sensitive values in the backing secret store.
    GlobalSecret:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the secret.
        id:
          type: string
          description: Unique identifier for the secret.
        plaintextFields:
          $ref: "#/components/schemas/GlobalSecretPlaintextFields"
          description: Non-sensitive secret attributes whose values are stored and
            returned in plaintext.
        secretReferences:
          $ref: "#/components/schemas/GlobalSecretReferences"
          description: References to sensitive secret fields in a secret store.
        secretType:
          $ref: "#/components/schemas/SecretTypeOptionsRestSecret"
        tags:
          type: string
          description: Tags for categorizing or organizing the secret.
      required:
        - id
        - secretReferences
        - secretType
      description: A global secret object returned by the API.
    GlobalSecretValues:
      type: object
      properties:
        password:
          type: string
          description: "Unencrypted password value. Use when creating or updating a global
            secret with <code>secretType: credentials</code> in the
            Cribl-managed secret store. Provide the username in
            <code>plaintextFields.username</code>. For external stores, use
            <code>secretReferences.password</code> instead. The Cribl-managed
            store automatically generates a
            <code>secretReferences.password</code> for the password to return in
            responses."
        secretKey:
          type: string
          description: "Unencrypted private key value. Use when creating or updating a
            global secret with <code>secretType: keypair</code> in the
            Cribl-managed secret store. Provide the API key in
            <code>plaintextFields.apiKey</code>. For external stores, use
            <code>secretReferences.secretKey</code> instead. The Cribl-managed
            store automatically generates a
            <code>secretReferences.secretKey</code> to return in responses."
        value:
          type: string
          description: "Unencrypted secret text value. Use when creating or updating a
            global secret with <code>secretType: text</code> in the
            Cribl-managed secret store. For external stores, use
            <code>secretReferences.value</code> instead. The Cribl-managed store
            automatically generates a <code>secretReferences.value</code> to
            return in responses."
      description: Unencrypted sensitive values for a global secret in a Cribl-managed
        secret store.
    GlobalSecretCreate:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the secret.
        id:
          type: string
          description: Unique identifier for the secret.
        plaintextFields:
          $ref: "#/components/schemas/GlobalSecretPlaintextFields"
          description: Non-sensitive secret attributes whose values are stored and
            returned in plaintext.
        secretReferences:
          $ref: "#/components/schemas/GlobalSecretReferences"
          description: References to existing secrets in the secret store.
        secretType:
          $ref: "#/components/schemas/SecretTypeOptionsRestSecret"
        secretValues:
          $ref: "#/components/schemas/GlobalSecretValues"
          description: Unencrypted sensitive values for a global secret in the
            Cribl-managed secret store.
        tags:
          type: string
          description: Tags for categorizing or organizing the secret.
      required:
        - id
        - secretType
      description: Request body for creating a global secret.
    CountedGlobalSecretReference:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GlobalSecretReference"
    GlobalSecretReferenceEntityType:
      type: string
      enum:
        - inputs
        - outputs
        - savedJobs
      description: Type of entity that references a global secret.
      x-speakeasy-unknown-values: allow
    GlobalSecretReference:
      type: object
      properties:
        entityId:
          type: string
          description: Unique identifier of the entity that references the global secret.
        entityType:
          $ref: "#/components/schemas/GlobalSecretReferenceEntityType"
          description: Type of the entity that references the global secret.
        fieldName:
          type: string
          description: Name of the field in the entity's configuration that stores the
            reference to the global secret.
        groupId:
          type: string
          description: The <code>id</code> of the Worker Group or Edge Fleet that contains
            the entity that references the global secret. Omitted when not
            applicable or unknown.
      required:
        - entityId
        - entityType
        - fieldName
      description: Entities that reference the global secret.
    GlobalSecretUpdate:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the global secret.
        id:
          type: string
          description: Unique identifier for the global secret.
        plaintextFields:
          $ref: "#/components/schemas/GlobalSecretPlaintextFields"
          description: Non-sensitive global secret fields that are stored and returned in
            plaintext.
        secretReferences:
          $ref: "#/components/schemas/GlobalSecretReferences"
          description: References to existing global secrets in the secret store.
        secretType:
          type: string
          enum:
            - credentials
            - keypair
            - text
          description: Type of the global secret.
          x-speakeasy-unknown-values: allow
        secretValues:
          $ref: "#/components/schemas/GlobalSecretValues"
          description: Unencrypted sensitive values for a global secret in the
            Cribl-managed secret store.
        tags:
          type: string
          description: Tags for categorizing or organizing the global secret.
      required:
        - id
      description: Request body for updating an existing global secret.
    CloudProvider:
      type:
        - string
        - "null"
      enum:
        - aws
        - azure
        - null
      x-speakeasy-unknown-values: allow
    ConfigGroupCloud:
      type: object
      properties:
        provider:
          $ref: "#/components/schemas/CloudProvider"
          description: Cloud provider for the Worker Group.
        region:
          type: string
          description: Cloud region where the Worker Group is deployed.
      required:
        - provider
        - region
    Commit:
      type: object
      properties:
        author_email:
          type: string
          description: Email address of the commit author.
        author_name:
          type: string
          description: Name of the commit author.
        date:
          type: string
          description: Date and time of the commit.
        hash:
          type: string
          description: Full commit hash.
        message:
          type: string
          description: Commit message.
        short:
          type: string
          description: Abbreviated commit hash.
      required:
        - date
        - hash
        - message
        - short
    ConfigGroupLookups:
      type: object
      properties:
        context:
          type: string
          description: The Worker or Node context for the lookup deployment.
        lookups:
          type: array
          items:
            type: object
            properties:
              deployedVersion:
                type: string
                description: Version of the lookup file currently deployed on the Worker or
                  Node.
              file:
                type: string
                description: File name of the deployed lookup.
              version:
                type: string
                description: Version of the lookup file currently staged for deployment.
            required:
              - file
          description: List of lookup files deployed to this context.
      required:
        - context
        - lookups
    ConfigGroup:
      type: object
      properties:
        cloud:
          $ref: "#/components/schemas/ConfigGroupCloud"
          description: Cloud provider and region details for a Cribl.Cloud Worker Group.
        configVersion:
          type: string
          description: "Commit hash of the deployed configuration version for the Worker
            Group, Outpost Group, or Edge Fleet. Automatically populated and
            returned in responses.<br/><br/> **Warning**: Do not change the
            value of <code>configVersion</code> in the body of PATCH requests.
            The PATCH request body must include the value as it appears in the
            <code>GET /products/{product}/groups/{id}</code> response."
        deployingWorkerCount:
          type: integer
          description: "Number of Workers or Nodes that are currently deploying the latest
            configuration version.<br/><br/> **Warning**: Do not change the
            value of <code>deployingWorkerCount</code> in the body of PATCH
            requests. The PATCH request body must include the value as it
            appears in the <code>GET /products/{product}/groups/{id}</code>
            response."
        description:
          type: string
          description: Brief description of the Worker Group, Outpost Group, or Edge Fleet.
          maxLength: 512
        estimatedIngestRate:
          $ref: "#/components/schemas/EstimatedIngestRateOptionsConfigGroup"
        git:
          type: object
          properties:
            commit:
              type: string
              description: Commit hash of the currently committed configuration version.
            localChanges:
              type: integer
              description: Number of local configuration changes not yet committed.
            log:
              type: array
              items:
                $ref: "#/components/schemas/Commit"
              description: List of recent configuration commits.
          description: Git status of the Worker Group, Outpost Group, or Edge Fleet
            configuration. Automatically populated and returned in responses.
        id:
          type: string
          description: Unique identifier.
        incompatibleWorkerCount:
          type: integer
          description: "Number of Workers or Nodes running a Cribl version that is
            incompatible with the current upgrade target.<br/><br/> **Warning**:
            Do not change the value of <code>incompatibleWorkerCount</code> in
            the body of PATCH requests. The PATCH request body must include the
            value as it appears in the <code>GET
            /products/{product}/groups/{id}</code> response."
        inherits:
          type: string
          description: The <code>id</code> of the parent Edge Fleet. If provided, this
            Fleet inherits configuration from the specified parent Fleet.
            Applies only to Edge Fleets.
        isFleet:
          type: boolean
          description: Indicates whether this is an Edge Fleet. Deprecated. Use to
            identify Edge Fleets.
          deprecated: true
        isSearch:
          type: boolean
          description: Indicates whether this is an internal Search Group. Deprecated. Use
            to identify Search Groups.
          deprecated: true
        lookupDeployments:
          type: array
          items:
            $ref: "#/components/schemas/ConfigGroupLookups"
          description: "Lookup deployment status per Worker or Node context.<br/><br/>
            **Warning**: Do not change the value of
            <code>lookupDeployments</code> in the body of PATCH requests. The
            PATCH request body must include the value as it appears in the
            <code>GET /products/{product}/groups/{id}</code> response."
        maxWorkerAge:
          type: string
          description: Maximum duration a Worker or Node can remain disconnected before
            the Leader removes it. The value is a numeral with units, such as
            <code>8h</code>, <code>5d</code>, <code>1w</code>.
        name:
          type: string
          description: Name of the Worker Group, Outpost Group, or Edge Fleet.
        onPrem:
          type: boolean
          description: If <code>true</code>, the Worker Group, Outpost Group, or Edge
            Fleet uses customer-hosted (on-prem) workers. If <code>false</code>,
            the Worker Group, Outpost Group, or Edge Fleet is managed in
            Cribl.Cloud.
        provisioned:
          type: boolean
          description: If <code>true</code>, the Cribl.Cloud Worker Group has active
            Workers provisioned. Applies only to Cribl.Cloud Worker Groups.
        streamtags:
          type: array
          items:
            type: string
          description: Metadata tags attached to the Worker Group, Outpost Group, or Edge
            Fleet for categorization, filtering, and tag-based routing and
            policy application. Useful for organizing Groups and Fleets and
            enabling tag-driven workflows in Cribl.
        tags:
          type: string
          description: Legacy system-level tags associated with the Worker Group, Outpost
            Group, or Edge Fleet. Use <code>streamtags</code> instead.
          deprecated: true
        type:
          $ref: "#/components/schemas/TypeOptionsConfigGroup"
        upgradeVersion:
          type: string
          description: Target software upgrade version. Applies only to Outpost Groups and
            Edge Fleets.
        workerCount:
          type: integer
          description: "Number of Workers or Nodes currently in the Worker Group, Outpost
            Group, or Edge Fleet. The value is automatically populated and
            **does not scale Cribl.Cloud Worker Groups**. Use
            <code>estimatedIngestRate</code> to scale Cribl.Cloud Worker Groups.
            <br/><br/> **Warning**: Do not change the value of
            <code>workerCount</code> in the body of PATCH requests. The PATCH
            request body must include the value as it appears in the <code>GET
            /products/{product}/groups/{id}</code> response."
        workerRemoteAccess:
          type: boolean
          description: If <code>true</code>, the Leader allows remote access (teleporting)
            into the Workers or Nodes of the Worker Group, Outpost Group, or
            Edge Fleet.
      required:
        - id
    CountedConfigGroup:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ConfigGroup"
    GroupCreateRequest:
      type: object
      properties:
        cloud:
          $ref: "#/components/schemas/ConfigGroupCloud"
          description: Cloud provider and region details for a Cribl.Cloud Worker Group.
        description:
          type: string
          description: Brief description of the Worker Group, Outpost Group, or Edge Fleet.
          maxLength: 512
        estimatedIngestRate:
          $ref: "#/components/schemas/EstimatedIngestRateOptionsConfigGroup"
        id:
          type: string
          description: Unique identifier.
        inherits:
          type: string
          description: The <code>id</code> of the parent Edge Fleet. If provided, this
            Fleet inherits configuration from the specified parent Fleet.
            Applies only to Edge Fleets.
        isFleet:
          type: boolean
          description: Indicates whether this is an Edge Fleet. Deprecated. Use to
            identify Edge Fleets.
          deprecated: true
        isSearch:
          type: boolean
          description: Indicates whether this is an internal Search Group. Deprecated. Use
            to identify Search Groups.
          deprecated: true
        maxWorkerAge:
          type: string
          description: Maximum duration a Worker or Node can remain disconnected before
            the Leader removes it. The value is a numeral with units, such as
            <code>8h</code>, <code>5d</code>, <code>1w</code>.
        name:
          type: string
          description: Name of the Worker Group, Outpost Group, or Edge Fleet.
        onPrem:
          type: boolean
          description: If <code>true</code>, the Worker Group, Outpost Group, or Edge
            Fleet uses customer-hosted (on-prem) workers. If <code>false</code>,
            the Worker Group, Outpost Group, or Edge Fleet is managed in
            Cribl.Cloud.
        provisioned:
          type: boolean
          description: If <code>true</code>, the Cribl.Cloud Worker Group has active
            Workers provisioned. Applies only to Cribl.Cloud Worker Groups.
        sourceGroupId:
          type: string
          description: The <code>id</code> of an existing Worker Group, Outpost Group, or
            Edge Fleet to copy configuration from when creating a new Group or
            Fleet.
        streamtags:
          type: array
          items:
            type: string
          description: Metadata tags attached to the Worker Group, Outpost Group, or Edge
            Fleet for categorization, filtering, and tag-based routing and
            policy application. Useful for organizing Groups and Fleets and
            enabling tag-driven workflows in Cribl.
        tags:
          type: string
          description: Legacy system-level tags associated with the Worker Group, Outpost
            Group, or Edge Fleet. Use <code>streamtags</code> instead.
          deprecated: true
        type:
          $ref: "#/components/schemas/TypeOptionsConfigGroup"
        upgradeVersion:
          type: string
          description: Target software upgrade version. Applies only to Outpost Groups and
            Edge Fleets.
        workerRemoteAccess:
          type: boolean
          description: If <code>true</code>, the Leader allows remote access (teleporting)
            into the Workers or Nodes of the Worker Group, Outpost Group, or
            Edge Fleet.
      required:
        - id
    DeployRequestLookups:
      type: object
      properties:
        context:
          type: string
        lookups:
          type: array
          items:
            type: object
            properties:
              file:
                type: string
              version:
                type: string
            required:
              - file
              - version
      required:
        - context
        - lookups
    DeployRequest:
      type: object
      properties:
        lookups:
          type: array
          items:
            $ref: "#/components/schemas/DeployRequestLookups"
        version:
          type: string
      required:
        - version
    ProductsAll:
      type: string
      enum:
        - stream
        - edge
        - search
        - lake
        - outpost
      x-speakeasy-unknown-values: allow
    ProductsCore:
      type: string
      enum:
        - stream
        - edge
        - outpost
      x-speakeasy-unknown-values: allow
    CountedTeamAccessControlList:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/TeamAccessControlList"
    TeamAccessControlList:
      type: object
      properties:
        perms:
          type: array
          items:
            $ref: "#/components/schemas/ResourcePolicy"
        team:
          type: string
      required:
        - perms
        - team
    CountedKeyMetadataEntity:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/KeyMetadataEntity"
    KeyMetadataEntity:
      type: object
      required:
        - keyId
        - algorithm
        - kms
        - keyclass
      properties:
        keyId:
          type: string
          title: Key ID
        description:
          type: string
          title: Description
        algorithm:
          type: string
          title: Encryption algorithm
          enum:
            - aes-256-cbc
            - aes-256-gcm
          x-speakeasy-unknown-values: allow
        kms:
          type: string
          title: KMS for this key
          enum:
            - local
          x-speakeasy-unknown-values: allow
        keyclass:
          type: number
          title: Key class
          minimum: 0
        created:
          type: number
          title: Creation time
        expires:
          type: number
          title: Expiration time
        plainKey:
          type: string
          title: Plain text key
        cipherKey:
          type: string
          title: Encrypted key
        useIV:
          type: boolean
          title: Use initialization vector
          description: Seed encryption with a
            [nonce](https://en.wikipedia.org/wiki/Cryptographic_nonce) to make
            the key more random and unique. Must be enabled with the aes-256-gcm
            algorithm.
        ivSize:
          type: integer
          title: Initialization vector size
          enum:
            - 12
            - 13
            - 14
            - 15
            - 16
          description: Length of the initialization vector, in bytes
          x-speakeasy-unknown-values: allow
          x-speakeasy-enums:
            - IvSize12
            - IvSize13
            - IvSize14
            - IvSize15
            - IvSize16
        group:
          type: string
          title: Group/Fleet
          description: Name of the Worker Group/Fleet that created this key
    ProductsBase:
      type: string
      enum:
        - stream
        - edge
      x-speakeasy-unknown-values: allow
    CountedRulesetId:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/RulesetId"
    RulesetId:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the Mapping Ruleset.
      required:
        - id
    CountedMappingRuleset:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/MappingRuleset"
    MappingRuleset:
      type: object
      additionalProperties: false
      description: Schema definition for a Mapping Ruleset.
      required:
        - id
      properties:
        id:
          type: string
          title: ID
          description: Unique identifier for the Mapping Ruleset.
          pattern: ^[a-zA-Z0-9_-]+$
        conf:
          type: object
          additionalProperties: false
          description: Configuration for the Mapping Ruleset.
          properties:
            functions:
              title: Functions
              description: List of functions to pass data through.
              type: array
              items:
                type: object
                required:
                  - conf
                  - id
                  - final
                additionalProperties: true
                properties:
                  id:
                    type: string
                    enum:
                      - eval
                    description: Function type. Always <code>eval</code> for Mapping Rules.
                  filter:
                    type: string
                    description: Boolean filter expression used to determine whether the Mapping
                      Rule applies. Evaluated against the Worker or Edge Node
                      context.
                  disabled:
                    type: boolean
                    description: If <code>true</code>, the function is disabled. Otherwise,
                      <code>false</code>.
                  final:
                    type: boolean
                    description: Always <code>true</code> to ensure that every Mapping Rule is
                      final. Once a Mapping Rule matches (its
                      <code>filter</code> evaluates to <code>true</code>), no
                      further Mapping Rules are evaluated for the Worker or Edge
                      Node. This prevents multiple group assignments.
                    const: true
                  description:
                    type: string
                    description: Brief description of the function.
                  conf:
                    type: object
                    description: Configuration for the Mapping Rule function.
                    required:
                      - add
                    properties:
                      add:
                        type: array
                        description: The group assignment action for the Mapping Rule.
                        minItems: 1
                        maxItems: 1
                        items:
                          type: object
                          required:
                            - name
                            - value
                          properties:
                            name:
                              type: string
                              const: groupId
                              description: Always <code>groupId</code> to specify the assignment type.
                            value:
                              type: string
                              description: The <code>id</code> of the group to assign the Worker or Edge Node
                                to if the Mapping Rule applies.
                              minLength: 1
        active:
          type: boolean
          description: If <code>true</code>, the Mapping Ruleset is active. Otherwise,
            <code>false</code>.
    CountedBulletinMessage:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/BulletinMessage"
    BulletinMessage:
      type: object
      additionalProperties: false
      required:
        - id
        - text
      properties:
        id:
          type: string
          title: Message ID
        severity:
          type: string
          title: Severity
          enum:
            - info
            - warn
            - error
            - fatal
          x-speakeasy-unknown-values: allow
        title:
          type: string
          title: Title
        text:
          type: string
          title: Text
        time:
          type: number
          title: Occurrence Time
        group:
          type: string
          title: Group
        metadata:
          type: array
          items:
            type: object
    NotificationTarget:
      type: object
      additionalProperties: true
      properties:
        id:
          type: string
          description: Unique identifier.
        type:
          type: string
      required:
        - id
        - type
    CountedNotificationTarget:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/NotificationTarget"
    CountedPolicyRule:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/PolicyRule"
    PolicyRule:
      type: object
      properties:
        args:
          type: array
          items:
            type: string
        description:
          type: string
        id:
          type: string
        template:
          type: array
          items:
            type: string
        title:
          type: string
      required:
        - id
        - template
    CountedProvisioningTokenWithSecret:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ProvisioningTokenWithSecret"
    TokenStatus:
      type: string
      enum:
        - active
        - revoked
        - expired
        - exhausted
      x-speakeasy-unknown-values: allow
    TokenType:
      type: string
      enum:
        - standard
        - legacy
      x-speakeasy-unknown-values: allow
    ProvisioningTokenWithSecret:
      type: object
      properties:
        createdAt:
          type: number
        description:
          type: string
        distMode:
          $ref: "#/components/schemas/DistModeOptionsProvisioningTokenWithSecret"
        expiresAt:
          type: number
        id:
          type: string
          description: Unique identifier for the provisioning token.
        revokedAt:
          type: number
        status:
          $ref: "#/components/schemas/TokenStatus"
          description: "Computed status of the provisioning token: <code>active</code>,
            <code>revoked</code>, <code>expired</code>, or
            <code>exhausted</code>."
        token:
          type: string
          description: "The plaintext provisioning token value. For a <code>type:
            standard</code> token, the value is the one-time plaintext JSON Web
            Token (JWT). For a <code>type: legacy</code> token, the value is the
            decrypted plaintext for tokens migrated from the legacy
            authentication system. Copy the <code>token</code> value
            immediately: <code>standard</code> tokens are never stored on the
            Leader."
        type:
          $ref: "#/components/schemas/TokenType"
          description: "Provisioning token type: <code>standard</code> (JWT) or
            <code>legacy</code> (migrated)."
        useCount:
          type: number
        useLimit:
          type: number
      required:
        - createdAt
        - description
        - id
        - status
        - token
        - type
        - useCount
    ProvisioningTokenCreate:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the provisioning token. May be an empty string
            if omitted from POST or PATCH requests.
        distMode:
          type: string
          enum:
            - edge
            - managed-edge
            - master
            - outpost
            - search-supervisor
            - single
            - worker
          description: The Node type that the provisioning token is restricted to. If
            omitted, the provisioning token is not restricted to a specific Node
            type.
          x-speakeasy-unknown-values: allow
        expiresAt:
          type: integer
          description: Timestamp (in Unix time) after which the provisioning token
            expires. Omit for no expiry.
          minimum: 0
        id:
          type: string
          description: Unique identifier for the provisioning token. Must start with a
            letter or digit and is limited to a maximum of 64 characters.
        useLimit:
          type: integer
          description: Maximum successful registrations. Omit for unlimited.
          minimum: 1
      required:
        - id
    CountedProvisioningToken:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ProvisioningToken"
    ProvisioningToken:
      type: object
      properties:
        createdAt:
          type: number
        description:
          type: string
        distMode:
          $ref: "#/components/schemas/DistModeOptionsProvisioningTokenWithSecret"
        expiresAt:
          type: number
        id:
          type: string
          description: Unique identifier for the provisioning token.
        revokedAt:
          type: number
        status:
          $ref: "#/components/schemas/TokenStatus"
          description: "Computed status of the provisioning token: <code>active</code>,
            <code>revoked</code>, <code>expired</code>, or
            <code>exhausted</code>."
        type:
          $ref: "#/components/schemas/TokenType"
          description: "Provisioning token type: <code>standard</code> (JWT) or
            <code>legacy</code> (migrated)."
        useCount:
          type: number
        useLimit:
          type: number
      required:
        - createdAt
        - description
        - id
        - status
        - type
        - useCount
    ProvisioningTokenRevokeRequest:
      type: object
      properties:
        reason:
          type: string
          description: Brief reason for revoking the provisioning token, recorded in the
            audit log.
    ProvisioningTokenUpdate:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the provisioning token. Defaults to empty
            string if omitted.
        distMode:
          type:
            - string
            - "null"
          enum:
            - edge
            - managed-edge
            - master
            - null
            - outpost
            - search-supervisor
            - single
            - worker
          description: The Node type that the provisioning token is restricted to.
            Defaults to <code>null</code> (no restriction) if omitted.
          x-speakeasy-unknown-values: allow
        expiresAt:
          type:
            - "null"
            - integer
          description: Timestamp (in Unix time) after which the provisioning token
            expires. Defaults to <code>null</code> (no expiry) if omitted.
          minimum: 0
        useLimit:
          type:
            - "null"
            - integer
          description: Maximum successful registrations. Defaults to <code>null</code>
            (unlimited) if omitted.
          minimum: 1
    Role:
      type: object
      properties:
        description:
          type: string
        id:
          type: string
          description: Unique identifier.
        policy:
          type: array
          items:
            type: string
        tags:
          type: array
          items:
            type: string
        title:
          type: string
      required:
        - id
        - policy
    CountedRole:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Role"
    ScriptLibEntry:
      type: object
      properties:
        args:
          type: array
          items:
            type: string
          description: Arguments to pass when executing the script.
        command:
          type: string
          description: Command to execute for the script.
        description:
          type: string
          description: Brief description of the script.
        env:
          type: object
          additionalProperties:
            type: string
          description: Key-value pairs that define extra environment variables to set when
            executing the script.
        id:
          type: string
          description: Unique identifier for the script.
          pattern: ^[^/]+$
      required:
        - command
        - id
    CountedScriptLibEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ScriptLibEntry"
    CountedSecretFolderWithRuntimeState:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SecretFolderWithRuntimeState"
    SharingConfig:
      type: object
      properties:
        fleetIds:
          type: array
          items:
            type: string
          description: List of the <code>id</code> values for Edge Fleets to share the
            secret folder with. Use <code>'*'</code> to share the secret folder
            with all Edge Fleets. All secrets within the secret folder become
            available to the Edge Fleets that it is shared with.
        groupIds:
          type: array
          items:
            type: string
          description: List of the <code>id</code> values for Worker Groups to share the
            secret folder with. Use <code>'*'</code> to share the secret folder
            with all Worker Groups. All secrets within the secret folder become
            available to the Worker Groups that it is shared with.
      description: Sharing configuration for a secret folder.
    SecretFolderWithRuntimeState:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the secret folder.
          example: Shared credentials for finance systems
        id:
          type: string
          description: Unique identifier for the secret folder.
          pattern: ^[a-zA-Z0-9_\-]+$
          example: finance
        secretStoreId:
          type: string
          description: Unique identifier for the backing secret store for the secret folder.
          pattern: ^[a-zA-Z0-9_\-]+$
          example: cribl
        sharing:
          $ref: "#/components/schemas/SharingConfig"
          description: Sharing configuration for the secret folder.
        lastReloadAt:
          type: integer
          description: Timestamp (in Unix time) when the secrets in the secret folder were
            last re-fetched from the backing secret store.
          example: 1717027200000
        secretCount:
          type: integer
          description: Number of secrets currently in the secret folder.
          example: 3
        secretStoreType:
          type:
            - string
            - "null"
          enum:
            - cribl
            - null
            - vault
          description: Type of the backing secret store for the folder. Null when the
            referenced store no longer exists or is otherwise unresolved.
          x-speakeasy-unknown-values: allow
          example: vault
      required:
        - id
        - secretStoreId
        - secretCount
        - secretStoreType
      description: A secret folder object including runtime state.
    SecretFolderCreate:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the secret folder.
          example: Shared credentials for finance systems
        id:
          type: string
          description: Unique identifier for the secret folder.
          example: finance
        secretStoreId:
          type: string
          description: Unique identifier for the backing secret store for the secret
            folder. *.
          example: cribl
        sharing:
          $ref: "#/components/schemas/SharingConfig"
          description: Sharing configuration for the secret folder.
      required:
        - id
        - secretStoreId
      description: Request body for creating a secret folder.
    CountedSecretFolderReloadResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SecretFolderReloadResponse"
    SecretFolderReloadResponse:
      type: object
      properties:
        success:
          type: boolean
          description: Whether the reload completed successfully.
      required:
        - success
      description: Result of re-fetching secrets in a folder from its store. The
        handler responds with HTTP 200 for every outcome; clients must read
        success to tell completion from failure (for example a missing folder or
        a backing-store error).
    SecretFolderUpdate:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the secret folder.
          example: Shared credentials for finance systems
        id:
          type: string
          description: Unique identifier of the secret folder to update.
          example: finance
        sharing:
          $ref: "#/components/schemas/SharingConfig"
          description: Sharing configuration for the secret folder.
      required:
        - id
      description: Request body for updating an existing secret folder.
    CountedSecretStoreWithRuntimeState:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SecretStoreWithRuntimeState"
    CriblStoreConfig:
      type: object
      additionalProperties: false
      description: Configuration for the built-in Cribl secret store (always empty).
    CriblSecretStore:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/CriblStoreConfig"
          description: Configuration for the Cribl secret store (always empty).
        description:
          type: string
          description: Optional description of the secret store.
          example: Vault-backed secret store for production credentials
        id:
          type: string
          description: Unique identifier for the secret store.
          pattern: ^[a-zA-Z0-9_\-]+$
          example: vault-prod
        type:
          type: string
          const: cribl
          description: Secret store type.
      required:
        - config
        - id
        - type
      description: The built-in Cribl secret store.
      title: CriblSecretStore
    VaultStoreConfig:
      type: object
      properties:
        address:
          type: string
          description: URL of the Vault server.
          pattern: ^https?://.*
          example: https://vault.example.com:8200
        namespace:
          type: string
          description: Vault namespace for the secret store.
          minLength: 1
          example: platform/team-a
      description: Configuration for a Vault secret store.
    VaultSecretStore:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/VaultStoreConfig"
          description: Configuration for the Vault secret store.
        description:
          type: string
          description: Optional description of the secret store.
          example: Vault-backed secret store for production credentials
        id:
          type: string
          description: Unique identifier for the secret store.
          pattern: ^[a-zA-Z0-9_\-]+$
          example: vault-prod
        type:
          type: string
          const: vault
          description: Secret store type.
      required:
        - config
        - id
        - type
      description: A Vault-backed secret store.
      title: VaultSecretStore
    SecretStoreWithRuntimeState:
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/CriblSecretStore"
            - $ref: "#/components/schemas/VaultSecretStore"
        - type: object
          properties:
            lastHealthCheckAt:
              type: integer
              description: Epoch timestamp in milliseconds of the last health check.
              example: 1717027200000
            status:
              type: string
              enum:
                - degraded
                - error
                - healthy
              description: Health status of the secret store.
              x-speakeasy-unknown-values: allow
              example: healthy
          required:
            - status
          description: Runtime health state of a secret store.
      description: A secret store object including runtime health state.
    SecretStoreCreate:
      $ref: "#/components/schemas/VaultSecretStore"
      description: Request body for creating a secret store.
    SecretStoreUpdate:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/VaultStoreConfig"
          description: Configuration of the secret store.
        description:
          type: string
          description: Description of the secret store.
          example: Vault-backed secret store for production credentials
        id:
          type: string
          description: Unique identifier of the secret store to update.
          pattern: ^[a-zA-Z0-9_\-]+$
          example: vault-prod
      required:
        - id
      description: Request body for updating fields of an existing secret store.
    CloudWorkspaceSchema:
      type: object
      properties:
        authToken:
          type: string
        authTokenRotated:
          type: boolean
          description: When <code>true</code>, merged settings prefer
            <code>authToken</code> from instance configuration over userinfo
            embedded in <code>CRIBL_DIST_MASTER_URL</code>. Set when the Leader
            rotates the node token via RESTProxy.
        compression:
          $ref: "#/components/schemas/TcpOutCompression"
        configBundles:
          $ref: "#/components/schemas/ConfigBundles"
        configHelperSocketDir:
          type: string
        connectionTimeout:
          type: number
        disableSNIRouting:
          type: boolean
        disabled:
          type: boolean
        failover:
          $ref: "#/components/schemas/FailoverConfigs"
        forwardToLeaderApi:
          type: boolean
        host:
          type: string
        ipWhitelistRegex:
          type: string
        maxActiveCxn:
          type: number
        maxBufferBytes:
          type: number
        port:
          type: number
        protocol:
          type: string
        proxy:
          $ref: "#/components/schemas/SocksProxyOpts"
        resiliency:
          $ref: "#/components/schemas/ResiliencyType"
        subscriptionAgreement:
          type: boolean
        tls:
          $ref: "#/components/schemas/TlsTypeOutpostConfigsListener"
        writeTimeout:
          type: number
      required:
        - disabled
        - host
        - port
        - subscriptionAgreement
    MasterSchema:
      type: object
      properties:
        authToken:
          type: string
        authTokenRotated:
          type: boolean
          description: When <code>true</code>, merged settings prefer
            <code>authToken</code> from instance configuration over userinfo
            embedded in <code>CRIBL_DIST_MASTER_URL</code>. Set when the Leader
            rotates the node token via RESTProxy.
        compression:
          $ref: "#/components/schemas/TcpOutCompression"
        configBundles:
          $ref: "#/components/schemas/ConfigBundles"
        configHelperSocketDir:
          type: string
        connectionTimeout:
          type: number
        disableSNIRouting:
          type: boolean
        failover:
          $ref: "#/components/schemas/FailoverConfigs"
        forwardToLeaderApi:
          type: boolean
        host:
          type: string
        ipWhitelistRegex:
          type: string
        maxActiveCxn:
          type: number
        maxBufferBytes:
          type: number
        port:
          type: number
        protocol:
          type: string
        proxy:
          $ref: "#/components/schemas/SocksProxyOpts"
        resiliency:
          $ref: "#/components/schemas/ResiliencyType"
        tls:
          $ref: "#/components/schemas/TlsTypeOutpostConfigsListener"
        writeTimeout:
          type: number
      required:
        - host
        - port
    InstanceSettings:
      type: object
      properties:
        cloudWorkspace:
          $ref: "#/components/schemas/CloudWorkspaceSchema"
        envRegex:
          type: string
        group:
          type: string
        id:
          type: string
        master:
          $ref: "#/components/schemas/MasterSchema"
        mode:
          $ref: "#/components/schemas/DistModeOptionsProvisioningTokenWithSecret"
        reportedDeploymentId:
          type: string
        tags:
          type: array
          items:
            type: string
      required:
        - id
        - mode
      title: InstanceSettings
    BootstrapSettings:
      type: object
      properties:
        bootstrapHost:
          type: string
        id:
          type: string
      title: BootstrapSettings
    InstanceSettingsSchema:
      oneOf:
        - $ref: "#/components/schemas/InstanceSettings"
        - $ref: "#/components/schemas/BootstrapSettings"
    CountedInstanceSettingsSchema:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/InstanceSettingsSchema"
    Team:
      type: object
      properties:
        description:
          type: string
        id:
          type: string
          description: Unique identifier.
        name:
          type: string
        roles:
          type: array
          items:
            type: string
        ssoGroupIds:
          type: array
          items:
            type: string
      required:
        - description
        - id
        - name
        - roles
    CountedTeam:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Team"
    CountedResourcePolicy:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ResourcePolicy"
    ProductsExtended:
      type: string
      enum:
        - stream
        - edge
        - outpost
        - search
      x-speakeasy-unknown-values: allow
    MembershipSchema:
      type: object
      properties:
        add:
          type: array
          items:
            type: string
        rm:
          type: array
          items:
            type: string
    IdentityType:
      type: string
      enum:
        - SINGLE_SIGN_ON
        - USERNAME_PASSWORD
      x-speakeasy-unknown-values: allow
    CloudMetadata:
      type: object
      properties:
        identityType:
          $ref: "#/components/schemas/IdentityType"
          description: The identity type of the user.
        ssoGroups:
          type: array
          items:
            type: string
          description: SSO group names the user belongs to.
    User:
      type: object
      properties:
        cloudMetadata:
          $ref: "#/components/schemas/CloudMetadata"
          description: Cloud-specific metadata for the user account.
        currentPassword:
          type: string
        disabled:
          type: boolean
          description: If <code>true</code>, the account is disabled and cannot
            authenticate.
        email:
          type: string
          description: Email address associated with the account.
        first:
          type: string
          description: First name of the account holder.
        id:
          type: string
          description: Unique identifier for the account. For API Credential accounts, the
            <code>id</code> value ends with <code>@clients</code>.
        last:
          type: string
          description: Last name of the account holder.
        password:
          type: string
          description: Account password. Omitted from responses.
        roles:
          type: array
          items:
            type: string
          description: Role <code>id</code> values assigned to the account. Each entry
            must match a Role defined on the deployment. Built-in IDs match the
            string values in the <code>DEFAULT_ROLES</code> export in the RBAC
            module (product roles, group and lake RBAC roles, and defaults such
            as <code>admin</code> and <code>user</code>). Custom Role
            <code>id</code> values from the List Roles API are also valid.
        teams:
          type: array
          items:
            type: string
        type:
          type: string
          enum:
            - user
            - credential
          x-speakeasy-unknown-values: allow
        username:
          type: string
          description: Name for the account.
        workspaceRoles:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeUserWorkspaceRoles"
          description: Cloud-specific mapping of cloud workspace IDs to the role IDs
            assigned in each workspace.
      required:
        - disabled
        - email
        - first
        - id
        - last
        - username
    CountedUser:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/User"
    CountedUserProfile:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/UserProfile"
    UserProfile:
      type: object
      properties:
        cloudMetadata:
          $ref: "#/components/schemas/CloudMetadata"
          description: Cloud-specific metadata for the user account.
        disabled:
          type: boolean
          description: If <code>true</code>, the account is disabled and cannot
            authenticate.
        email:
          type: string
          description: Email address associated with the account.
        first:
          type: string
          description: First name of the account holder.
        id:
          type: string
          description: Unique identifier for the account. For API Credential accounts, the
            <code>id</code> value ends with <code>@clients</code>.
        last:
          type: string
          description: Last name of the account holder.
        password:
          type: string
          description: Account password. Omitted from responses.
        roles:
          type: array
          items:
            type: string
          description: Role <code>id</code> values assigned to the account. Each entry
            must match a Role defined on the deployment. Built-in IDs match the
            string values in the <code>DEFAULT_ROLES</code> export in the RBAC
            module (product roles, group and lake RBAC roles, and defaults such
            as <code>admin</code> and <code>user</code>). Custom Role
            <code>id</code> values from the List Roles API are also valid.
        username:
          type: string
          description: Name for the account.
        workspaceRoles:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeUserWorkspaceRoles"
          description: Cloud-specific mapping of cloud workspace IDs to the role IDs
            assigned in each workspace.
      required:
        - disabled
        - email
        - first
        - id
        - last
        - username
    UserInfo:
      type: object
      properties:
        cloudMetadata:
          $ref: "#/components/schemas/CloudMetadata"
          description: Cloud-specific metadata for the user account.
        currentPassword:
          type: string
        disabled:
          type: boolean
          description: If <code>true</code>, the account is disabled and cannot
            authenticate.
        email:
          type: string
          description: Email address associated with the account.
        first:
          type: string
          description: First name of the account holder.
        id:
          type: string
          description: Unique identifier for the account. For API Credential accounts, the
            <code>id</code> value ends with <code>@clients</code>.
        last:
          type: string
          description: Last name of the account holder.
        password:
          type: string
          description: Account password. Omitted from responses.
        roles:
          type: array
          items:
            type: string
          description: Role <code>id</code> values assigned to the account. Each entry
            must match a Role defined on the deployment. Built-in IDs match the
            string values in the <code>DEFAULT_ROLES</code> export in the RBAC
            module (product roles, group and lake RBAC roles, and defaults such
            as <code>admin</code> and <code>user</code>). Custom Role
            <code>id</code> values from the List Roles API are also valid.
        username:
          type: string
          description: Name for the account.
        workspaceRoles:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeUserWorkspaceRoles"
          description: Cloud-specific mapping of cloud workspace IDs to the role IDs
            assigned in each workspace.
      required:
        - disabled
        - email
        - first
        - id
        - last
        - username
    SessionInfo:
      type: object
      properties:
        createdAt:
          type: number
        createdBy:
          type: string
        displayCreatedBy:
          type: string
        displayModifiedBy:
          type: string
        modifiedAt:
          type: number
        modifiedBy:
          type: string
      required:
        - createdAt
        - createdBy
        - displayCreatedBy
        - modifiedAt
        - modifiedBy
    StoredMessage:
      type: object
      additionalProperties: true
    Session:
      type: object
      properties:
        agentSlug:
          type: string
        context:
          type: object
          additionalProperties: true
        id:
          type: string
        info:
          $ref: "#/components/schemas/SessionInfo"
        messages:
          type: array
          items:
            $ref: "#/components/schemas/StoredMessage"
        title:
          type: string
        version:
          type: number
      required:
        - agentSlug
        - id
        - info
        - messages
        - title
        - version
    CountedSession:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Session"
    CountedCriblLakeBucket:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/CriblLakeBucket"
    Credentials:
      type: object
      properties:
        apiKey:
          type: string
          description: AWS access key ID. Required when <code>method</code> is
            <code>manual</code>.
        method:
          type: string
          enum:
            - auto
            - auto_rpc
            - manual
          description: "Authentication method used to access the Cribl Lake
            bucket.<br/><br/> <code>auto</code>: Automatic credential
            resolution<br/> <code>auto_rpc</code>: RPC-based automatic
            resolution<br/> <code>manual</code>: Explicit credentials."
          x-speakeasy-unknown-values: allow
        roleToAssume:
          type: string
          description: ARN of the AWS IAM role to assume for accessing the Cribl Lake
            bucket.
        roleToAssumeExternalId:
          type: string
          description: External ID to use when assuming the AWS IAM role. For Netskope
            buckets, this is the external ID for the Netskope-writer IAM role.
        roleToAssumeHybrid:
          type: string
          description: ARN of the AWS IAM role to assume for hybrid Worker access to the
            Cribl Lake bucket.
        secretKey:
          type: string
          description: AWS secret access key. Required when <code>method</code> is
            <code>manual</code>.
        tenantId:
          type: string
          description: Azure tenant ID. Required for <code>azure_blob</code> Storage
            Providers.
      required:
        - method
    CriblLakeLifecycleItemStatus:
      type: string
      enum:
        - provisioning
        - ready
        - failed
        - terminated
        - delayed
        - blocked
      x-speakeasy-unknown-values: allow
    WriterCredentials:
      type: object
      properties:
        roleToAssume:
          type: string
          description: ARN of the IAM role granted to the external party for writing.
        roleToAssumeExternalId:
          type: string
          description: External ID required when assuming the writer role.
        trustedPrincipal:
          type: string
          description: The AWS principal ARN trusted to assume the writer role.
    CriblLakeBucket:
      type: object
      properties:
        credentials:
          $ref: "#/components/schemas/Credentials"
          description: Credentials used to authenticate access to the Cribl Lake bucket.
        description:
          type: string
          description: Brief description of the Cribl Lake bucket.
        id:
          type: string
          description: Unique identifier for the Cribl Lake bucket. Must match the
            <code>name</code>.
        name:
          type: string
          description: Name of the Cribl Lake bucket. Must match the <code>id</code>.
        region:
          type: string
          description: AWS region where the Cribl Lake bucket is provisioned.
        retentionPeriodInDays:
          type: integer
          description: Retention period for data in the Cribl Lake bucket, in days.
        status:
          $ref: "#/components/schemas/CriblLakeLifecycleItemStatus"
          description: Provisioning status of the Cribl Lake bucket. Automatically
            populated and returned in responses.
        storageLocationId:
          type: string
          description: The <code>id</code> of the Storage Location associated with the
            Cribl Lake bucket.
        trustedPrincipal:
          type: string
          description: AWS IAM principal trusted by the Cribl Lake bucket. Used for DDSS
            buckets.
        type:
          type: string
          enum:
            - data
            - ddss
            - external
            - internal
            - netskope
          description: Type of the Cribl Lake bucket.
          x-speakeasy-unknown-values: allow
        writerCredentials:
          $ref: "#/components/schemas/WriterCredentials"
          description: Credentials for the IAM role granted to an external party for
            writing to the bucket. Only present on <code>netskope</code>
            buckets.
      required:
        - credentials
        - id
        - name
        - retentionPeriodInDays
        - type
    PublicLakeBucketType:
      type: string
      enum:
        - ddss
        - external
        - netskope
      x-speakeasy-unknown-values: allow
    CountedLakeConfigItem:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/LakeConfigItem"
    LakeConfigItem:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the configuration limit listed as the
            <code>id</code>.
        id:
          type: string
          description: "Identifier for the configuration limit.<br/><br/>
            <code>MAX_LAKEHOUSES</code>: Maximum number of Lakehouses allowed in
            the Lake<br/> <code>MAX_LAKEHOUSE_INDEXED_FIELDS_COUNT</code>:
            Maximum number of indexed fields allowed per Lakehouse<br/>
            <code>MAX_ACCELERATED_FIELDS_COUNT</code>: Maximum number of
            accelerated (partition) fields allowed per Lake Dataset<br/>
            <code>MAX_HTTPDA_DATASETS_COUNT</code>: Maximum number of HTTP
            Direct Access datasets allowed in the Lake<br/>
            <code>MAX_LAKE_STORAGE_LOCATIONS_COUNT</code>: Maximum number of
            Storage Locations allowed in the Lake."
        value:
          type: object
          additionalProperties: true
          description: The configured value for the limit listed as the <code>id</code>.
          example: "3"
      required:
        - id
        - value
    ConfigType:
      type: string
      enum:
        - maxAcceleratedFieldsCount
        - maxHTTPDADatasetsCount
        - maxLakeStorageLocationsCount
        - maxLakehouseIndexedFieldsCount
        - maxlakehouses
      x-speakeasy-unknown-values: allow
    CountedCriblLakeDataset:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/CriblLakeDataset"
    CacheConnectionBackfillStatus:
      type: string
      enum:
        - scheduled
        - pending
        - started
        - finished
        - incomplete
      x-speakeasy-unknown-values: allow
    LakehouseConnectionType:
      type: string
      enum:
        - cache
        - zeroPoint
      x-speakeasy-unknown-values: allow
    CacheConnection:
      type: object
      properties:
        acceleratedFields:
          type: array
          items:
            type: string
          description: Accelerated fields (materialized columns) for the cache connection.
        backfillStatus:
          $ref: "#/components/schemas/CacheConnectionBackfillStatus"
          description: Backfill status for data being loaded into the cache.
        cacheRef:
          type: string
          description: Unique identifier for the Lakehouse cache referenced by the Dataset.
        createdAt:
          type: number
          description: Timestamp (in Unix time) when the continuous data feed to the
            Lakehouse cache started, in milliseconds.
        lakehouseConnectionType:
          $ref: "#/components/schemas/LakehouseConnectionType"
          description: If <code>new</code>, the Lakehouse was attached before data existed
            in the Dataset. If <code>existing</code>, the Lakehouse was attached
            after data existed in the Dataset.
        migrationQueryId:
          type: string
          description: Unique identifier for the active Lakehouse migration query. Omitted
            if no migration is in progress.
        retentionInDays:
          type: number
          description: Retention period for the Lakehouse cache connection, in days.
      required:
        - cacheRef
        - createdAt
        - retentionInDays
    LakeDatasetMetrics:
      type: object
      properties:
        currentSizeBytes:
          type: number
          description: Total current logical size of the Dataset, in bytes.
        metricsDate:
          type: string
          description: Timestamp (in Unix time) when the metrics snapshot was generated,
            as a YYYY-MM-DD calendar date.
      required:
        - currentSizeBytes
        - metricsDate
    DatasetMetadataRunInfo:
      type: object
      properties:
        earliestScannedTime:
          type: integer
          description: Timestamp (in Unix time) for the earliest event that was observed
            during the scan (seconds).
        finishedAt:
          type: integer
          description: Timestamp (in Unix time) when the acceleration run finished
            (milliseconds).
        latestScannedTime:
          type: integer
          description: Timestamp (in Unix time) for the latest event that was observed
            during the scan (seconds).
        objectCount:
          type: integer
          description: Number of objects on the acceleration manifest after the scan
            completed.
    DatasetMetadata:
      type: object
      properties:
        earliest:
          type: string
          description: Rolling time window that defines how far back acceleration scans.
          example: -30d
        enableAcceleration:
          type: boolean
          description: If <code>true</code>, the system automatically backfills and
            refreshes Dataset metadata. Otherwise, <code>false</code>.
        fieldList:
          type: array
          items:
            type: string
          description: Fields for which acceleration gathers statistics. Required when
            scan mode is <code>detailed</code>.
        latestRunInfo:
          $ref: "#/components/schemas/DatasetMetadataRunInfo"
          description: Details from the most recent acceleration scan.
        scanMode:
          type: string
          enum:
            - detailed
            - quick
          description: Acceleration scan mode. <code>quick</code> collects object-level
            metadata; <code>detailed</code> also collects field-level
            statistics.
          x-speakeasy-unknown-values: allow
      required:
        - earliest
        - enableAcceleration
        - fieldList
        - scanMode
    PathFilterDataFormat:
      type: string
      enum:
        - ndjson
        - parquet
      x-speakeasy-unknown-values: allow
    ObjectStorageFilter:
      type: object
      properties:
        dataPathFormat:
          $ref: "#/components/schemas/PathFilterDataFormat"
          description: Row format for Search v2 Lake path filters.
        dataTypeId:
          type: string
          description: Datatype identifier that maps filtered objects to a data type
            definition.
        filter:
          type: string
          description: Glob pattern for selecting files within the storage path.
        preprocessOuterJson:
          type: boolean
          description: When true, instructs the C++ reader to unwrap the outer JSON
            envelope before applying the user datatype to the nested _raw field.
            Set for Cribl Lake NDJSON filters only.
      required:
        - dataTypeId
        - filter
    SearchVersion:
      type: string
      enum:
        - v1
        - v2
      x-speakeasy-unknown-values: allow
    LakeDatasetSearchConfig:
      type: object
      properties:
        datatypes:
          type: array
          items:
            type: string
          description: Datatype identifiers assigned to the Dataset for search-time event
            classification.
        description:
          type: string
          description: Brief description of the Dataset search configuration.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Key-value metadata for the Dataset search configuration.
        pathFilters:
          type: array
          items:
            $ref: "#/components/schemas/ObjectStorageFilter"
          description: Glob-to-Datatype mappings for the Lake bucket path. Used only for
            search execution v2.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Cribl Lake Dataset. Search
            execution v1 uses Event Breakers and Datatypes, and v2 uses path
            filters. If omitted, default is v1.
        tags:
          type: string
          description: Comma-separated tags for the Dataset search configuration.
    CriblLakeDataset:
      type: object
      properties:
        acceleratedFields:
          type: array
          items:
            type: string
          description: Accelerated fields for the Dataset. Data is partitioned by these
            fields in storage to improve query performance.
        bucketName:
          type: string
          description: Name of the legacy Cribl Lake bucket that backs the Dataset.
            Mutually exclusive with <code>storageLocationId</code>.
        cacheConnection:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection settings for the Dataset.
        deletionStartedAt:
          type: number
          description: Timestamp (in Unix time) when Dataset deletion was initiated, in
            milliseconds.
        description:
          type: string
          description: Brief description of the Dataset.
        format:
          $ref: "#/components/schemas/FormatOptionsCriblLakeDataset"
        httpDAUsed:
          type: boolean
          description: If <code>true</code>, the Dataset is used by Direct Access HTTP.
            Otherwise, <code>false</code>.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metrics:
          $ref: "#/components/schemas/LakeDatasetMetrics"
          description: Most recent Dataset metrics snapshot.
        retentionPeriodInDays:
          type: integer
          description: Dataset retention period, in days.
        searchConfig:
          $ref: "#/components/schemas/LakeDatasetSearchConfig"
          description: Search configuration for the Dataset.
        storageClass:
          $ref: "#/components/schemas/StorageClassOptionsCriblLakeDataset"
        storageLocationId:
          type: string
          description: Unique identifier for the Storage Location that backs the Dataset.
            Mutually exclusive with <code>bucketName</code>.
        viewName:
          type: string
          description: Name of the ClickHouse view for the Dataset on the Lakehouse.
      required:
        - id
    DatasetFormatFilter:
      type: string
      const: ddss
    CriblLakeDatasetUpdate:
      type: object
      properties:
        acceleratedFields:
          type: array
          items:
            type: string
          description: Accelerated fields for the Dataset. Data is partitioned by these
            fields in storage to improve query performance.
        bucketName:
          type: string
          description: Name of the legacy Cribl Lake bucket that backs the Dataset.
            Mutually exclusive with <code>storageLocationId</code>.
        cacheConnection:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection settings for the Dataset.
        deletionStartedAt:
          type: number
          description: Timestamp (in Unix time) when Dataset deletion was initiated, in
            milliseconds.
        description:
          type: string
          description: Brief description of the Dataset.
        format:
          $ref: "#/components/schemas/FormatOptionsCriblLakeDataset"
        httpDAUsed:
          type: boolean
          description: If <code>true</code>, the Dataset is used by Direct Access HTTP.
            Otherwise, <code>false</code>.
        id:
          type: string
          description: Unique identifier for the Dataset. Optional; the path parameter
            <code>id</code> is authoritative.
        metrics:
          $ref: "#/components/schemas/LakeDatasetMetrics"
          description: Most recent Dataset metrics snapshot.
        retentionPeriodInDays:
          type: integer
          description: Dataset retention period, in days.
        searchConfig:
          $ref: "#/components/schemas/LakeDatasetSearchConfig"
          description: Search configuration for the Dataset.
        storageClass:
          $ref: "#/components/schemas/StorageClassOptionsCriblLakeDataset"
        storageLocationId:
          type: string
          description: Unique identifier for the Storage Location that backs the Dataset.
            Mutually exclusive with <code>bucketName</code>.
        viewName:
          type: string
          description: Name of the ClickHouse view for the Dataset on the Lakehouse.
    CountedCriblLakeDirectAccessItem:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/CriblLakeDirectAccessItem"
    ElasticsearchAuthTokenMetadata:
      type: object
      properties:
        defaultDataset:
          type: string
          description: Default Lake Dataset to route events to.
        enabled:
          type: boolean
          description: If <code>true</code>, Elasticsearch ingest is enabled for the
            authentication token.
      required:
        - defaultDataset
        - enabled
    DirectAccessAuthTokenMetadata:
      type: object
      properties:
        name:
          type: string
          description: Name of the metadata field to add to events.
        value:
          type: string
          description: Value of the metadata field to add to events.
      required:
        - name
        - value
    SplunkHecAuthTokenMetadata:
      type: object
      properties:
        allowedIndexesAtToken:
          type: array
          items:
            type: string
          description: List of index names that the authentication token can write to.
        defaultDataset:
          type: string
          description: Default Lake Dataset to route events to when
            <code>allowedIndexesAtToken</code> is omitted.
        enabled:
          type: boolean
          description: If <code>true</code>, Splunk HEC ingest is enabled for the
            authentication token.
      required:
        - defaultDataset
        - enabled
    DirectAccessAuthToken:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the <code>token</code>.
        elasticsearchMetadata:
          $ref: "#/components/schemas/ElasticsearchAuthTokenMetadata"
          description: Elasticsearch-specific metadata for the <code>token</code>.
        metadata:
          type: array
          items:
            $ref: "#/components/schemas/DirectAccessAuthTokenMetadata"
          description: Metadata fields and values to add to events ingested with the
            <code>token</code>.
        splunkHecMetadata:
          $ref: "#/components/schemas/SplunkHecAuthTokenMetadata"
          description: Splunk HEC-specific metadata for the <code>token</code>.
        token:
          type: string
          description: Authentication token value for Direct Access HTTP ingest.
      required:
        - token
    CriblLakeDirectAccessItem:
      type: object
      properties:
        authTokens:
          type: array
          items:
            $ref: "#/components/schemas/DirectAccessAuthToken"
          description: List of authentication tokens for Direct Access HTTP ingest.
        id:
          type: string
          description: Unique identifier for the Direct Access HTTP Source.
        ingestUrl:
          type: string
          description: The ingest URL for the Direct Access HTTP Source.<br/><br/>
            Deprecated. Use <code>ingestUrls</code> instead.
          deprecated: true
        ingestUrls:
          type: array
          items:
            type: object
            properties:
              type:
                type: string
                enum:
                  - ndjson
                  - hec
                  - elasticsearch
                x-speakeasy-unknown-values: allow
              url:
                type: string
            required:
              - type
              - url
          description: List of protocol types and ingest URLs for the Direct Access HTTP
            Source.
        lastProvisionedMs:
          type: integer
          description: Timestamp (in Unix time) when the Cribl Lake resource was last
            provisioned. Automatically populated.
        status:
          $ref: "#/components/schemas/CriblLakeLifecycleItemStatus"
          description: Provisioning status of the Cribl Lake resource. Automatically
            populated.
      required:
        - authTokens
        - id
    CountedCriblLakeStorageLocation:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/CriblLakeStorageLocation"
    CriblLakeStorageLocation:
      type: object
      required:
        - provider
        - config
        - credentials
      additionalProperties: false
      properties:
        id:
          type: string
          title: ID
          pattern: ^[a-zA-Z0-9_-]+$
          maxLength: 512
          description: Unique identifier for the Storage Location.
        description:
          type: string
          description: Brief description of the Storage Location.
        status:
          $ref: "#/components/schemas/StatusOptionsCriblLakeStorageLocation"
        provider:
          $ref: "#/components/schemas/ProviderOptionsCriblLakeStorageLocation"
        config:
          $ref: "#/components/schemas/ConfigTypeCriblLakeStorageLocation"
        credentials:
          $ref: "#/components/schemas/CredentialsTypeCriblLakeStorageLocation"
        lastProvisionedMs:
          type: number
          description: Timestamp (in Unix time) when the Storage Location was last
            provisioned.
          readOnly: true
        metricsLastGenerated:
          type: number
          description: Timestamp (in Unix time) when storage metrics were last computed.
          readOnly: true
        validateOnly:
          type: boolean
        writerCredentials:
          $ref: "#/components/schemas/WriterCredentialsTypeCriblLakeStorageLocation"
    CountedAzureSpStatus:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AzureSpStatus"
    AzureSpStatus:
      type: object
      properties:
        exists:
          type: boolean
          description: when admin consent has been granted and the SP exists in the
            customer's tenant. when the SP does not exist (consent never
            granted, or Enterprise Application has been deleted).
      required:
        - exists
    CountedAzurePrincipalObjectId:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AzurePrincipalObjectId"
    AzurePrincipalObjectId:
      type: object
      properties:
        objectId:
          type: string
          description: The object ID of the Cribl service principal in the customer's
            Azure AD tenant. Use this value to populate the ARM template.
      required:
        - objectId
    CountedAzureSpIds:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AzureSpIds"
    AzureSpIds:
      type: object
      properties:
        clientId:
          type: string
          description: The Azure AD application (client) ID of the Cribl service principal.
        redirectUri:
          type: string
          description: The redirect URI registered on the Azure AD app, used as the
            post-consent redirect target in the admin consent URL.
      required:
        - clientId
        - redirectUri
    CriblLakeStorageLocationUpdate:
      type: object
      additionalProperties: false
      properties:
        id:
          type: string
          title: ID
          pattern: ^[a-zA-Z0-9_-]+$
          maxLength: 512
          description: Unique identifier for the Storage Location.
        description:
          type: string
          description: Brief description of the Storage Location.
        status:
          $ref: "#/components/schemas/StatusOptionsCriblLakeStorageLocation"
        provider:
          $ref: "#/components/schemas/ProviderOptionsCriblLakeStorageLocation"
        config:
          $ref: "#/components/schemas/ConfigTypeCriblLakeStorageLocation"
        credentials:
          $ref: "#/components/schemas/CredentialsTypeCriblLakeStorageLocation"
        lastProvisionedMs:
          type: number
          description: Timestamp (in Unix time) when the Storage Location was last
            provisioned.
          readOnly: true
        metricsLastGenerated:
          type: number
          description: Timestamp (in Unix time) when storage metrics were last computed.
          readOnly: true
        validateOnly:
          type: boolean
        writerCredentials:
          $ref: "#/components/schemas/WriterCredentialsTypeCriblLakeStorageLocation"
    DashboardCategory:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the Dashboard Collection.
        id:
          type: string
          description: Unique identifier for the Dashboard Collection.
        isPack:
          type: boolean
          description: If <code>true</code>, the Collection represents a Pack that
            contains Dashboards rather than a user-created Collection.
        name:
          type: string
          description: Display name for the Dashboard Collection.
      required:
        - id
        - name
    CountedDashboardCategory:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DashboardCategory"
    FieldMappingType:
      type: object
      properties:
        fieldName:
          type: string
          description: Target field name to populate.
        source:
          type: string
          description: Kusto expression or field name that provides the value.
      required:
        - fieldName
        - source
    DelimitedExtractionConfig:
      type: object
      properties:
        containsHeaderRow:
          type: boolean
          description: Indicates that the source file contains a header row.
        delimiter:
          type: string
          description: Field delimiter that separates columns in delimited text.
        escape:
          type: string
          description: Escape character for embedded quotes or special characters.
        extractionType:
          type: string
          const: delimited
          description: Extraction type. Must be <code>delimited</code>.
        fieldList:
          type: array
          items:
            type: string
          description: Optional list of fields to extract.
        nullValue:
          type: string
          description: Value substituted when a column is empty or null.
        quote:
          type: string
          description: Quote character used to wrap fields that contain the delimiter.
      required:
        - delimiter
        - extractionType
      title: DelimitedExtractionConfig
    JsonExtractionConfig:
      type: object
      properties:
        extractionType:
          type: string
          const: json
          description: Extraction type. Must be <code>json</code>.
      required:
        - extractionType
      description: JSON extraction configuration. Parses each event as JSON. No
        additional fields are required.
      title: JsonExtractionConfig
    KvpExtractionConfig:
      type: object
      properties:
        delimiter:
          type: string
          description: Separator between key-value pairs.
        equals:
          type: string
          description: Separator between keys and values within each pair.
        extractionType:
          type: string
          const: kvp
          description: Extraction type. Must be <code>kvp</code>.
      required:
        - delimiter
        - equals
        - extractionType
      title: KvpExtractionConfig
    RegexpExtractionConfig:
      type: object
      properties:
        extractionType:
          type: string
          const: regexp
          description: Extraction type. Must be <code>regexp</code>.
        regexpList:
          type: array
          items:
            type: object
            properties:
              overwrite:
                type: boolean
                description: If <code>true</code>, named captures from this pattern overwrite
                  existing fields. If <code>false</code> or omitted, named
                  captures are applied only when the field is not already set.
              regexp:
                type: string
                description: Regular expression pattern. Use named capture groups to extract
                  fields.
            required:
              - regexp
          description: Regular expression rules applied in order. Each entry defines a
            pattern and optional overwrite behavior.
      required:
        - extractionType
        - regexpList
      description: Regular expression extraction configuration. Extracts fields using
        an ordered list of regular expressions.
      title: RegexpExtractionConfig
    XmlTransformer:
      type: string
      enum:
        - apple_p_list
        - win_event
      x-speakeasy-unknown-values: allow
    XmlExtractionConfig:
      type: object
      properties:
        extractionType:
          type: string
          const: xml
          description: Extraction type. Must be <code>xml</code>.
        keepAttr:
          type: boolean
          description: If <code>true</code>, include XML attributes in the parsed output.
        keepMetadata:
          type: boolean
          description: "If <code>true</code>, include extraction metadata in the output.
            Requires <code>keepAttr: true</code>."
        nonValues:
          type: array
          items:
            type: string
          description: Element values to exclude from the parsed output. Elements whose
            text matches any value in this list are omitted.
        transformer:
          $ref: "#/components/schemas/XmlTransformer"
          description: Named transformer to apply during XML extraction.
          examples:
            - win_event
            - apple_p_list
      required:
        - extractionType
      title: XmlExtractionConfig
    ExtractionConfig:
      oneOf:
        - $ref: "#/components/schemas/DelimitedExtractionConfig"
        - $ref: "#/components/schemas/JsonExtractionConfig"
        - $ref: "#/components/schemas/KvpExtractionConfig"
        - $ref: "#/components/schemas/RegexpExtractionConfig"
        - $ref: "#/components/schemas/XmlExtractionConfig"
    DataFormat:
      type: string
      enum:
        - ndjson
        - delimited
        - json_array
        - kvp
        - parquet
        - raw
        - xml
      x-speakeasy-unknown-values: allow
    LocalSearchContext:
      type: object
      properties:
        datagenSampleId:
          type: string
          description: Sample ID from <code>samples.yml</code> used with datagen for event
            generation.
        fuzzkitGenerator:
          type: object
          properties:
            logType:
              type: string
              description: Log type for the FuzzKit generator.
            vendor:
              type: string
              description: Vendor name for the FuzzKit generator.
          required:
            - logType
            - vendor
          description: Explicit FuzzKit generator linkage, overriding inference from the
            Datatype ID.
        kustoExpression:
          type: string
          description: Kusto expression used to auto-detect the Datatype. Present when the
            Datatype participates in auto-detection.
    TimestampExtractionType:
      type: string
      enum:
        - auto
        - manual
      x-speakeasy-unknown-values: allow
    DataTypeDescriptor:
      allOf:
        - type: object
          properties:
            addFields:
              type: array
              items:
                $ref: "#/components/schemas/FieldMappingType"
              description: Computed fields to add to each event. Each entry specifies a field
                name and a source expression.
            additionalExtractions:
              type: array
              items:
                allOf:
                  - type: object
                    properties:
                      name:
                        type: string
                        description: Name of the additional extraction.
                      sourceField:
                        type: string
                        description: Field to use as input for the extraction.
                    required:
                      - name
                      - sourceField
                  - oneOf:
                      - $ref: "#/components/schemas/DelimitedExtractionConfig"
                      - $ref: "#/components/schemas/JsonExtractionConfig"
                      - $ref: "#/components/schemas/KvpExtractionConfig"
                      - $ref: "#/components/schemas/RegexpExtractionConfig"
                      - $ref: "#/components/schemas/XmlExtractionConfig"
              description: Additional extractions applied after the primary extraction.
            automaticExtraction:
              $ref: "#/components/schemas/ExtractionConfig"
              description: Primary extraction configuration applied to each event. Not
                required for raw or Parquet formats.
            dataFormat:
              $ref: "#/components/schemas/DataFormat"
              description: Data format of the Datatype, which determines how files are broken
                into events.
            description:
              type: string
              description: Brief description of the Datatype.
            id:
              type: string
              description: Unique identifier for the Datatype.
            lib:
              $ref: "#/components/schemas/CriblLib"
              description: Library scope for the Datatype. Value is <code>custom</code> for
                user-defined Datatypes or <code>cribl</code> for built-in
                Datatypes.
            localSearch:
              $ref: "#/components/schemas/LocalSearchContext"
              description: Configuration for lakehouse engine, such as auto-detection
                expressions.
            maxEventBytes:
              type: integer
              description: Maximum event size before truncation, in bytes.
            schemaMap:
              type: array
              items:
                $ref: "#/components/schemas/FieldMappingType"
              description: Field mappings to rename or alias extracted fields.
            shouldUseDataRaw:
              type: boolean
              description: If <code>true</code>, applies v1-style nested <code>_raw</code>
                JSON semantics for Cribl Lake Search v2 Datasets.
            tags:
              type: string
              description: Comma-separated tags for the Datatype.
            timestampExtraction:
              allOf:
                - type: object
                  properties:
                    anchorRegex:
                      type: string
                      description: Regular expression that restricts where the timestamp parser scans
                        within <code>sourceField</code>.
                    earliest:
                      type: string
                      description: Earliest allowed timestamp as a relative time string. Older parsed
                        timestamps are clamped.
                      example: '"-42years"'
                    latest:
                      type: string
                      description: Latest allowed timestamp as a relative time string. Newer parsed
                        timestamps are clamped.
                      example: '"+42days"'
                    sourceField:
                      type: string
                      description: Event field to scan for timestamps. If omitted, the entire event
                        payload is scanned.
                    timezone:
                      type: string
                      description: Default timezone applied when parsed timestamps do not include a
                        timezone offset.
                    type:
                      $ref: "#/components/schemas/TimestampExtractionType"
                      description: Timestamp extraction mode. Value is <code>auto</code> for automatic
                        detection or <code>manual</code> for an explicit format
                        string.
                  required:
                    - type
                - oneOf:
                    - type: object
                      properties:
                        scanDepth:
                          type: integer
                          description: Number of characters to scan beyond the anchor before falling back
                            to the current time.
                        type:
                          type: string
                          const: auto
                      required:
                        - scanDepth
                        - type
                    - type: object
                      properties:
                        format:
                          type: string
                          description: Timestamp format string compatible with <code>strptime</code>
                            syntax.
                        type:
                          type: string
                          const: manual
                      required:
                        - format
                        - type
              description: Timestamp extraction rules applied after all extractions complete.
          required:
            - dataFormat
            - id
            - lib
            - timestampExtraction
        - oneOf:
            - type: object
              properties:
                automaticExtraction:
                  $ref: "#/components/schemas/JsonExtractionConfig"
                  description: JSON extraction configuration applied to each newline-delimited
                    JSON event.
                dataFormat:
                  type: string
                  const: ndjson
                  description: Data format. Must be <code>ndjson</code>.
              required:
                - automaticExtraction
                - dataFormat
            - type: object
              properties:
                automaticExtraction:
                  $ref: "#/components/schemas/DelimitedExtractionConfig"
                  description: Delimited text extraction configuration applied to each event.
                dataFormat:
                  type: string
                  const: delimited
                  description: Data format. Must be <code>delimited</code>.
              required:
                - automaticExtraction
                - dataFormat
            - type: object
              properties:
                automaticExtraction:
                  $ref: "#/components/schemas/JsonExtractionConfig"
                  description: JSON extraction configuration applied to each element of the JSON
                    array.
                dataFormat:
                  type: string
                  const: json_array
                  description: Data format. Must be <code>json_array</code>.
              required:
                - automaticExtraction
                - dataFormat
            - type: object
              properties:
                automaticExtraction:
                  $ref: "#/components/schemas/KvpExtractionConfig"
                  description: Key-value pair extraction configuration applied to each event.
                dataFormat:
                  type: string
                  const: kvp
                  description: Data format. Must be <code>kvp</code>.
              required:
                - automaticExtraction
                - dataFormat
            - type: object
              properties:
                dataFormat:
                  type: string
                  const: parquet
                  description: Data format. Must be <code>parquet</code>.
              required:
                - dataFormat
            - type: object
              properties:
                dataFormat:
                  type: string
                  const: raw
                  description: Data format. Must be <code>raw</code>.
              required:
                - dataFormat
            - type: object
              properties:
                automaticExtraction:
                  $ref: "#/components/schemas/XmlExtractionConfig"
                  description: XML extraction configuration applied to each event.
                dataFormat:
                  type: string
                  const: xml
                  description: Data format. Must be <code>xml</code>.
              required:
                - automaticExtraction
                - dataFormat
    CountedDataTypeDescriptor:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DataTypeDescriptor"
    NotebookConfig:
      type: object
      properties:
        display:
          $ref: "#/components/schemas/NotebookDisplayConfig"
          description: Display settings for the Notebook layout.
        interaction:
          $ref: "#/components/schemas/NotebookInteractionConfig"
          description: Interaction settings for run-on-load and editing behavior.
    NotebookInfo:
      type: object
      properties:
        created:
          type: integer
          description: Timestamp (in Unix time) when the resource was created in
            milliseconds. Set by the server on save.
        createdBy:
          type: string
          description: User ID of the user who created the resource. Set by the server on
            save.
        createdFrom:
          $ref: "#/components/schemas/CreatedFrom"
          description: Reference to the source Notebook or template that was used to
            create the Notebook.
        description:
          type: string
          description: Brief description of the resource.
        displayCreatedBy:
          type: string
          description: Display username of the creator (resolved from user ID). Set by the
            server on save.
        displayModifiedBy:
          type: string
          description: Display username of the last modifier (resolved from user ID). Set
            by the server on save.
        modified:
          type: integer
          description: Timestamp (in Unix time) when the resource was last modified, in
            milliseconds. Set by the server on save.
        modifiedBy:
          type: string
          description: User ID of the user who last modified the resource. Set by the
            server on save.
        name:
          type: string
          description: Display name of the resource.
      required:
        - created
        - createdBy
        - modified
        - name
    NotebookPublishInfo:
      type: object
      properties:
        displayPublishedBy:
          type: string
          description: Display name of the user who published the Notebook.
        published:
          type: integer
          description: Timestamp (in Unix time) when the Notebook was published, in
            milliseconds.
        publishedBy:
          type: string
          description: Username of the user who published the Notebook.
      required:
        - displayPublishedBy
        - published
        - publishedBy
    RunInfo:
      type: object
      properties:
        displayRunBy:
          type: string
          description: Display name of the user who most recently ran the search for the
            Notebook section.
        jobId:
          type: string
          description: Unique identifier of the search job that most recently produced the
            results for the Notebook section.
        runBy:
          type: string
          description: Username of the user who most recently ran the search for the
            Notebook section.
        runQuery:
          type: string
          description: The search query that was most recently executed for the Notebook
            section.
        runTime:
          type: integer
          description: Timestamp (in Unix time) when the search for the Notebook section
            was last run, in milliseconds.
      required:
        - jobId
        - runBy
        - runTime
    VisualizationSection:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/ElementConfigType"
          description: Visualization or Input configuration object.
        displayConfig:
          $ref: "#/components/schemas/DisplayConfigTypeTemplateVisualizationSection"
        id:
          type: string
          description: Unique identifier for the element.
        info:
          $ref: "#/components/schemas/SectionInfo"
        runInfo:
          $ref: "#/components/schemas/RunInfo"
        search:
          $ref: "#/components/schemas/SearchQuery"
          description: Search query configuration that drives this visualization.
        type:
          $ref: "#/components/schemas/VisualizationElementType"
          description: Visualization type.
          example: chart.line
        variant:
          $ref: "#/components/schemas/VariantOptionsTemplateVisualizationSection"
      required:
        - id
        - info
        - search
        - type
        - variant
      title: VisualizationSection
    MarkdownSection:
      type: object
      properties:
        citation:
          type: array
          items:
            type: string
        config:
          $ref: "#/components/schemas/MarkdownElementConfig"
          description: Markdown-specific configuration (content, loading state).
        displayConfig:
          $ref: "#/components/schemas/DisplayConfigTypeTemplateVisualizationSection"
        id:
          type: string
          description: Unique identifier for the element.
        info:
          $ref: "#/components/schemas/SectionInfo"
        type:
          $ref: "#/components/schemas/MarkdownElementType"
          description: "Markdown element type: markdown.default or markdown.copilot."
        variant:
          type: string
          const: markdown
          description: Element variant. Always <code>markdown</code> for Markdown elements.
      required:
        - id
        - info
        - type
        - variant
      title: MarkdownSection
    Notebook:
      type: object
      properties:
        config:
          $ref: "#/components/schemas/NotebookConfig"
          description: Configuration for Notebook display and interaction behavior.
        id:
          type: string
          description: Unique identifier for the Notebook.
        info:
          $ref: "#/components/schemas/NotebookInfo"
          description: Metadata about the Notebook, including name, creator, and
            modification history.
        publishInfo:
          $ref: "#/components/schemas/NotebookPublishInfo"
          description: Information about when and by whom the Notebook was published.
        resolvedDatasetIds:
          type: array
          items:
            type: string
          description: List of the <code>id</code> for each Dataset that the Dashboard
            references.
        schemaVersion:
          $ref: "#/components/schemas/V1"
          description: Schema version of the Notebook format.
        sectionCount:
          type: integer
          description: Number of sections in the Notebook.
        sections:
          oneOf:
            - type: array
              items:
                oneOf:
                  - $ref: "#/components/schemas/VisualizationSection"
                  - $ref: "#/components/schemas/MarkdownSection"
            - type: "null"
          description: Ordered array of Notebook sections, including visualizations and
            Markdown panels.
      required:
        - id
        - info
        - sections
    CountedNotebook:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Notebook"
    CountedNotebookActivityResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/NotebookActivityResult"
    NotebookActivityResult:
      type: object
      properties:
        endOfResults:
          type: boolean
          description: If <code>true</code>, there are no more activity events to retrieve.
        events:
          type: array
          items:
            type: object
            additionalProperties: true
          description: Array of activity events for the Notebook.
        offset:
          type: string
          description: Opaque pagination token. Pass this value as the <code>offset</code>
            query parameter in the next request to retrieve the next page of
            results.
      required:
        - endOfResults
        - events
        - offset
    NotebookActivityEventInput:
      type: object
      properties:
        type:
          type: string
          const: view
          description: Type of activity event.
    CountedUsageGroup:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/UsageGroup"
    NumberOrPercent:
      oneOf:
        - type: number
        - type: string
          pattern: ^[0-9]+%$
    SchedulingLimitRule:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the rule.
        limit:
          $ref: "#/components/schemas/NumberOrPercent"
          description: Non-negative integer concurrent-search limit, or a percentage string.
        metric:
          type: string
          description: Optional metric identifier aggregated for enforcement.
        type:
          type: string
          enum:
            - maxConcurrentAdhocSearchesPerUser
            - maxConcurrentScheduledSearchesPerUser
            - maxConcurrentSearches
          description: Identifier for a scheduling-stage limit.
          x-speakeasy-unknown-values: allow
      required:
        - limit
        - type
    LimitRule:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the rule.
        limit:
          type: number
          description: Numeric threshold for the rule.
        metric:
          type: string
          description: Optional metric identifier aggregated for enforcement.
        type:
          type: string
          enum:
            - coordinatorHeapMemoryLimit
            - maxBytesReadPerSearch
            - maxExecutorsPerSearch
            - maxRelativeEarliestTimerange
            - maxResultsPerSearch
            - maxRunningTimePerSearch
            - maxTimerangeWidth
          description: Limit type.
          x-speakeasy-unknown-values: allow
      required:
        - limit
        - type
    LimitRuleDefinitions:
      type: object
      properties:
        maxRelativeEarliestTimerange:
          $ref: "#/components/schemas/LimitRule"
        maxTimerangeWidth:
          $ref: "#/components/schemas/LimitRule"
        maxConcurrentAdhocSearchesPerUser:
          $ref: "#/components/schemas/SchedulingLimitRule"
        maxConcurrentScheduledSearchesPerUser:
          $ref: "#/components/schemas/SchedulingLimitRule"
        maxConcurrentSearches:
          $ref: "#/components/schemas/SchedulingLimitRule"
        maxBytesReadPerSearch:
          $ref: "#/components/schemas/LimitRule"
        maxRunningTimePerSearch:
          $ref: "#/components/schemas/LimitRule"
        maxResultsPerSearch:
          $ref: "#/components/schemas/LimitRule"
        maxExecutorsPerSearch:
          $ref: "#/components/schemas/LimitRule"
        coordinatorHeapMemoryLimit:
          $ref: "#/components/schemas/LimitRule"
    UsageGroup:
      type: object
      properties:
        coordinatorHeapMemoryLimit:
          type: integer
          description: Optional coordinator heap memory limit value when the deployment
            stores it at the group level (interpretation follows usage-group
            configuration and UI schemas).
        description:
          type: string
          description: Brief description of the Usage Group.
        enabled:
          type: boolean
          description: Enables or disables the Usage Group.
        id:
          type: string
          description: Unique identifier for this Usage Group.
        rules:
          $ref: "#/components/schemas/LimitRuleDefinitions"
          description: Limit Rules for this Usage Group, keyed by limit type.
        users:
          type: object
          additionalProperties:
            type: object
            properties:
              email:
                type: string
                description: Email address shown for the member in Usage Group administration.
              id:
                type: string
                description: Unique identifier for the user, representing a stable ID from the
                  deployment identity system.
            required:
              - email
              - id
            description: Membership record for a user assigned to a Usage Group.
          description: Membership record for a user assigned to a Usage Group.
        usersCount:
          type: integer
          description: Count of members in the Usage Group.
          minimum: 0
      required:
        - id
        - rules
    CountedDatasetProviderType:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DatasetProviderType"
    DatasetProviderCapability:
      type: string
      enum:
        - read
        - list
      x-speakeasy-unknown-values: allow
    DatasetOrigin:
      type: string
      enum:
        - leader_local
        - remote
        - worker_local
      x-speakeasy-unknown-values: allow
    OriginConfig:
      type: object
      properties:
        filterExpression:
          type: string
        origin:
          $ref: "#/components/schemas/DatasetOrigin"
      required:
        - origin
    DatasetProviderType:
      type: object
      properties:
        capabilities:
          type: array
          items:
            $ref: "#/components/schemas/DatasetProviderCapability"
          description: Supported operations for the Dataset Provider type.
        description:
          type: string
          description: Description of the Dataset Provider type.
        id:
          type: string
          enum:
            - amazon_security_lake
            - api_aws
            - api_azure
            - api_azure_data_explorer
            - api_elasticsearch
            - api_gcp
            - api_google_workspace
            - api_http
            - api_log_analytics
            - api_msgraph
            - api_okta
            - api_opensearch
            - api_tailscale
            - api_zoom
            - azure_blob
            - clickhouse
            - cribl_edge
            - cribl_lake
            - cribl_leader
            - cribl_local
            - cribl_meta
            - cribl_search
            - gcs
            - prometheus
            - s3
            - snowflake
          description: Type identifier that matches the <code>type</code> field on Dataset
            Provider configurations.
          x-speakeasy-unknown-values: allow
        locality:
          $ref: "#/components/schemas/OriginConfig"
          description: Origin placement hints for Leader or Worker filtering, when
            applicable.
      required:
        - capabilities
        - id
    EventBreakerRuleFields:
      type: object
      properties:
        name:
          type: string
        value:
          type: string
      required:
        - name
        - value
    ParserMode:
      type: string
      enum:
        - extract
        - reserialize
      x-speakeasy-unknown-values: allow
    DelimParserConf:
      type: object
      properties:
        allowedKeyChars:
          type: boolean
        allowedValueChars:
          type: array
          items:
            type: string
        cleanFields:
          type: array
          items:
            type: string
        delimChar:
          type: string
        dstField:
          type: string
        escapeChar:
          type: string
        fieldFilterExpr:
          type: string
        fields:
          type: array
          items:
            type: string
        keep:
          type: array
          items:
            type: string
        mode:
          $ref: "#/components/schemas/ParserMode"
        nullValue:
          type: string
        quoteChar:
          type: string
        remove:
          type: array
          items:
            type: string
        srcField:
          type: string
        type:
          type: string
          enum:
            - csv
            - clf
            - delim
            - elff
          x-speakeasy-unknown-values: allow
      required:
        - mode
        - srcField
        - type
      title: DelimParserConf
    GrokParserConf:
      type: object
      properties:
        dstField:
          type: string
        mode:
          $ref: "#/components/schemas/ParserMode"
        pattern:
          type: string
        patternList:
          type: array
          items:
            type: object
            properties:
              pattern:
                type: string
            required:
              - pattern
        source:
          type: string
        srcField:
          type: string
        type:
          type: string
          const: grok
      required:
        - mode
        - srcField
        - type
      title: GrokParserConf
    KvpParserConf:
      type: object
      properties:
        allowedKeyChars:
          type: boolean
        allowedValueChars:
          type: array
          items:
            type: string
        cleanFields:
          type: array
          items:
            type: string
        delimChar:
          type: string
        dstField:
          type: string
        escapeChar:
          type: string
        fieldFilterExpr:
          type: string
        fields:
          type: array
          items:
            type: string
        keep:
          type: array
          items:
            type: string
        mode:
          $ref: "#/components/schemas/ParserMode"
        nullValue:
          type: string
        quoteChar:
          type: string
        remove:
          type: array
          items:
            type: string
        srcField:
          type: string
        type:
          type: string
          const: kvp
      required:
        - mode
        - srcField
        - type
      title: KvpParserConf
    JsonParserConf:
      type: object
      properties:
        cleanFields:
          type: array
          items:
            type: string
        dstField:
          type: string
        fieldFilterExpr:
          type: string
        fields:
          type: array
          items:
            type: string
        keep:
          type: array
          items:
            type: string
        mode:
          $ref: "#/components/schemas/ParserMode"
        remove:
          type: array
          items:
            type: string
        srcField:
          type: string
        type:
          type: string
          const: json
      required:
        - mode
        - srcField
        - type
      title: JsonParserConf
    RegexContainer:
      type: object
      properties:
        regex:
          type: string
      required:
        - regex
    RegexExtractParserConf:
      type: object
      properties:
        dstField:
          type: string
        mode:
          $ref: "#/components/schemas/ParserMode"
        srcField:
          type: string
        fieldNameExpression:
          type: string
        iterations:
          type: number
        overwrite:
          type: boolean
        regex:
          type: string
        regexList:
          type: array
          items:
            $ref: "#/components/schemas/RegexContainer"
        type:
          type: string
          const: regex
      required:
        - mode
        - srcField
        - regex
        - type
      title: RegexExtractParserConf
    BrokenEventProcessor:
      type: object
      properties: {}
    TimeZoneFullInfo:
      type: object
      properties:
        name:
          type: string
        offsets:
          type: array
          items:
            type: number
        untils:
          type: array
          items:
            type: number
      required:
        - name
        - offsets
        - untils
      title: TimeZoneFullInfo
    EventBreakerRule:
      type: object
      properties:
        cleanFields:
          type: boolean
        condition:
          type: string
        delimiter:
          type: string
        delimiterRegex:
          type: string
        disabled:
          type: boolean
        escapeChar:
          type: string
        eventBreakerRegex:
          type: string
        fields:
          type: array
          items:
            $ref: "#/components/schemas/EventBreakerRuleFields"
        fieldsLineRegex:
          type: string
        fieldsToRemove:
          type: array
          items:
            type: string
        headerLineRegex:
          type: string
        index:
          type: number
        jsonArrayField:
          type: string
        jsonExtractAll:
          type: boolean
        jsonTimeField:
          type: string
        maxEventBytes:
          type: number
        name:
          type: string
        nullFieldVal:
          type: string
        parentFieldsToCopy:
          type: array
          items:
            type: string
        parser:
          oneOf:
            - $ref: "#/components/schemas/DelimParserConf"
            - $ref: "#/components/schemas/GrokParserConf"
            - $ref: "#/components/schemas/KvpParserConf"
            - $ref: "#/components/schemas/JsonParserConf"
            - $ref: "#/components/schemas/RegexExtractParserConf"
        parserEnabled:
          type: boolean
        parserProcessor:
          $ref: "#/components/schemas/BrokenEventProcessor"
        quoteChar:
          type: string
        shouldUseDataRaw:
          type: boolean
        timeField:
          type: string
        timestamp:
          type: object
          properties:
            format:
              type: string
            length:
              type: number
            type:
              type: string
              enum:
                - auto
                - format
                - current
              x-speakeasy-unknown-values: allow
          required:
            - type
        timestampAnchorRegex:
          type: string
        timestampEarliest:
          type: string
        timestampLatest:
          type: string
        timestampSourceField:
          type: string
        timestampTimezone:
          oneOf:
            - type: string
            - $ref: "#/components/schemas/TimeZoneFullInfo"
        type:
          type: string
          enum:
            - regex
            - json
            - json_array
            - header
            - timestamp
            - csv
            - aws_cloudtrail
            - aws_vpcflow
            - azure_flowlog
          x-speakeasy-unknown-values: allow
      required:
        - condition
        - maxEventBytes
        - name
        - timestamp
        - timestampAnchorRegex
        - timestampTimezone
    DatasetProviderAmazonSecurityLake:
      type: object
      properties:
        type:
          type: string
          const: amazon_security_lake
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    AwsAccountConfig:
      type: object
      properties:
        assumeRoleArn:
          type: string
          description: IAM role ARN to assume when using automatic credentials.
          pattern: "^arn:"
          minLength: 20
        assumeRoleExternalId:
          type: string
          description: External ID required by the role trust policy when assuming the role.
        awsApiKey:
          type: string
          description: AWS access key ID when using manual key authentication.
        awsSecretKey:
          type: string
          description: AWS secret access key when using manual key authentication.
        awsSessionToken:
          type: string
          description: Temporary session token for short-lived credentials.
        name:
          type: string
          description: Display name that identifies the account configuration.
          minLength: 1
    DatasetProviderApiAws:
      type: object
      properties:
        type:
          type: string
          const: api_aws
        accountConfigs:
          type: array
          items:
            $ref: "#/components/schemas/AwsAccountConfig"
          description: Credential sets used to call AWS APIs for this Dataset Provider (at
            least one).
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - accountConfigs
        - id
    AzureAccountConfig:
      type: object
      properties:
        clientId:
          type: string
          description: Azure AD application (client) ID for API access.
          minLength: 1
        clientSecret:
          type: string
          description: Azure AD application client secret.
          minLength: 1
        name:
          type: string
          description: Display name that identifies the account configuration.
          minLength: 1
        tenantId:
          type: string
          description: Azure AD tenant ID that owns the application registration.
          minLength: 1
      required:
        - clientId
        - clientSecret
        - tenantId
    DatasetProviderApiAzure:
      type: object
      properties:
        type:
          type: string
          const: api_azure
        accountConfigs:
          type: array
          items:
            $ref: "#/components/schemas/AzureAccountConfig"
          description: Credential sets used to call Azure APIs for the Dataset Provider.
          minItems: 1
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - accountConfigs
        - id
    DatasetProviderApiAzureDataExplorer:
      type: object
      properties:
        type:
          type: string
          const: api_azure_data_explorer
        clientId:
          type: string
          description: Application (client) ID for the Entra ID application used to query
            Kusto.
          minLength: 1
        clientSecret:
          type: string
          description: Client secret for the Entra ID application.
          minLength: 1
        tenantId:
          type: string
          description: Microsoft Entra tenant ID authorized for Azure Data Explorer access.
          minLength: 1
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - clientId
        - clientSecret
        - tenantId
        - id
    DatasetProviderApiElasticsearch:
      type: object
      properties:
        type:
          type: string
          const: api_elasticsearch
        endpoint:
          type: string
          description: Base URL for the OpenSearch HTTP API (cluster endpoint).
        password:
          type: string
          description: Password for HTTP basic authentication to OpenSearch.
        username:
          type: string
          description: Username for HTTP basic authentication to OpenSearch.
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - endpoint
        - password
        - username
        - id
    GcpAccountConfig:
      type: object
      properties:
        name:
          type: string
          description: Display name that identifies the account configuration.
          minLength: 1
        serviceAccountCredentials:
          type: string
          description: JSON key downloaded from Google Cloud Console for a service account
            that can call GCP APIs.
          minLength: 1
      required:
        - serviceAccountCredentials
    DatasetProviderApiGcp:
      type: object
      properties:
        type:
          type: string
          const: api_gcp
        accountConfigs:
          type: array
          items:
            $ref: "#/components/schemas/GcpAccountConfig"
          description: List of credential sets used to call GCP APIs for the Dataset
            Provider.
          minItems: 1
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - accountConfigs
        - id
    GoogleWorkspaceAccountConfig:
      type: object
      properties:
        name:
          type: string
          description: Display name that identifies the account configuration.
          minLength: 1
        serviceAccountCredentials:
          type: string
          description: JSON key material for a Google Workspace domain-wide delegated
            service account.
          minLength: 1
        subject:
          type: string
          description: Admin user email address that the service account impersonates for
            Reports API access.
          minLength: 1
      required:
        - serviceAccountCredentials
        - subject
    DatasetProviderApiGoogleWorkspace:
      type: object
      properties:
        type:
          type: string
          const: api_google_workspace
        accountConfigs:
          type: array
          items:
            $ref: "#/components/schemas/GoogleWorkspaceAccountConfig"
          description: Credential sets used to call Google Workspace APIs for the Dataset
            Provider.
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - accountConfigs
        - id
    DatasetProviderApiHttp:
      type: object
      properties:
        type:
          type: string
          const: api_http
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    DatasetProviderApiLogAnalytics:
      type: object
      properties:
        type:
          type: string
          const: api_log_analytics
        clientId:
          type: string
          description: Application (client) ID for the Entra ID application used to query
            Log Analytics.
          minLength: 1
        clientSecret:
          type: string
          description: Client secret for the Entra ID application.
          minLength: 1
        tenantId:
          type: string
          description: Microsoft Entra tenant ID authorized for Azure Log Analytics access.
          minLength: 1
        workspaceId:
          type: string
          description: Azure Log Analytics workspace ID (GUID) this provider connects to.
          minLength: 1
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - clientId
        - clientSecret
        - tenantId
        - workspaceId
        - id
    MsGraphAccountConfig:
      type: object
      properties:
        clientId:
          type: string
          description: Application (client) ID registered in Entra ID.
          minLength: 1
        clientSecret:
          type: string
          description: Client secret for the registered application.
          minLength: 1
        name:
          type: string
          description: Display name that identifies the account configuration.
          minLength: 1
        tenantId:
          type: string
          description: Microsoft Entra ID (Azure AD) tenant ID.
          minLength: 1
      required:
        - clientId
        - clientSecret
        - tenantId
    DatasetProviderApiMsgraph:
      type: object
      properties:
        type:
          type: string
          const: api_msgraph
        accountConfigs:
          type: array
          items:
            $ref: "#/components/schemas/MsGraphAccountConfig"
          description: Credential sets used to call Microsoft Graph for this Dataset
            Provider (at least one).
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - accountConfigs
        - id
    OktaAccountConfig:
      type: object
      properties:
        apiToken:
          type: string
          description: API token used to authorize Okta API requests.
          minLength: 1
        domainEndpoint:
          type: string
          description: Hostname of the Okta org URL.
          minLength: 1
        name:
          type: string
          description: Display name that identifies the account configuration.
          minLength: 1
      required:
        - apiToken
        - domainEndpoint
    DatasetProviderApiOkta:
      type: object
      properties:
        type:
          type: string
          const: api_okta
        accountConfigs:
          type: array
          items:
            $ref: "#/components/schemas/OktaAccountConfig"
          description: Credential sets used to call Okta APIs for this Dataset Provider.
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - accountConfigs
        - id
    DatasetProviderApiOpensearch:
      type: object
      properties:
        type:
          type: string
          const: api_opensearch
        endpoint:
          type: string
          description: Base URL for the OpenSearch HTTP API (cluster endpoint).
        password:
          type: string
          description: Password for HTTP basic authentication to OpenSearch.
        username:
          type: string
          description: Username for HTTP basic authentication to OpenSearch.
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - endpoint
        - password
        - username
        - id
    TailscaleAccountConfig:
      type: object
      properties:
        clientId:
          type: string
          description: OAuth client ID from the Tailscale API credentials.
          minLength: 1
        clientSecret:
          type: string
          description: OAuth client secret from the Tailscale API credentials.
          minLength: 1
        name:
          type: string
          description: Display name that identifies the account configuration.
          minLength: 1
      required:
        - clientId
        - clientSecret
    DatasetProviderApiTailscale:
      type: object
      properties:
        type:
          type: string
          const: api_tailscale
        accountConfigs:
          type: array
          items:
            $ref: "#/components/schemas/TailscaleAccountConfig"
          description: Credential sets used to call Tailscale APIs for the Dataset Provider.
          minItems: 1
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - accountConfigs
        - id
    ZoomAccountConfig:
      type: object
      properties:
        accountId:
          type: string
          description: Zoom account identifier tied to these credentials.
          minLength: 1
        clientId:
          type: string
          description: OAuth client ID from the Zoom Marketplace app.
          minLength: 1
        clientSecret:
          type: string
          description: OAuth client secret from the Zoom Marketplace app.
          minLength: 1
        name:
          type: string
          description: Display name that identifies the account configuration.
          minLength: 1
      required:
        - accountId
        - clientId
        - clientSecret
    DatasetProviderApiZoom:
      type: object
      properties:
        type:
          type: string
          const: api_zoom
        accountConfigs:
          type: array
          items:
            $ref: "#/components/schemas/ZoomAccountConfig"
          description: Credential sets used to call Zoom APIs for this Dataset Provider
            (at least one).
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - accountConfigs
        - id
    DatasetProviderAzureBlob:
      type: object
      properties:
        type:
          type: string
          const: azure_blob
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    DatasetProviderClickhouse:
      type: object
      properties:
        type:
          type: string
          const: clickhouse
        endpoint:
          type: string
          description: Base URL for the ClickHouse HTTP interface used by Search (scheme,
            host, optional port).
          minLength: 1
        password:
          type: string
          description: Password for the ClickHouse user; optional when the server allows
            empty passwords.
        username:
          type: string
          description: ClickHouse user name used for HTTP basic authentication.
          minLength: 1
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - endpoint
        - username
        - id
    DatasetProviderCriblEdge:
      type: object
      properties:
        type:
          type: string
          const: cribl_edge
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    DatasetProviderCriblLake:
      type: object
      properties:
        type:
          type: string
          const: cribl_lake
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    DatasetProviderCriblLeader:
      type: object
      properties:
        type:
          type: string
          const: cribl_leader
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    DatasetProviderCriblLocal:
      type: object
      properties:
        type:
          type: string
          const: cribl_local
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    DatasetProviderCriblMeta:
      type: object
      properties:
        type:
          type: string
          const: cribl_meta
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    DatasetProviderCriblSearch:
      type: object
      properties:
        type:
          type: string
          const: cribl_search
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    DatasetProviderGcs:
      type: object
      properties:
        type:
          type: string
          const: gcs
        endpoint:
          type: string
          description: Optional custom API endpoint; omit to use the default GCS endpoint
            for the bucket region.
        serviceAccountCredentials:
          type: string
          description: Credentials for a Google Cloud service account used to access GCS.
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - serviceAccountCredentials
        - id
    DatasetProviderPrometheus:
      type: object
      properties:
        type:
          type: string
          const: prometheus
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    AwsAuthenticationMethod:
      type: string
      enum:
        - auto
        - manual
        - secret
      x-speakeasy-unknown-values: allow
    DatasetProviderS3:
      type: object
      properties:
        type:
          type: string
          const: s3
        assumeRoleArn:
          type: string
          description: IAM role ARN to assume when using automatic credentials.
        assumeRoleExternalId:
          type: string
          description: External ID for the assume-role trust relationship, when required
            by the role trust policy.
        awsApiKey:
          type: string
          description: AWS access key ID when using manual authentication.
        awsAuthenticationMethod:
          $ref: "#/components/schemas/AwsAuthenticationMethod"
          description: Whether credentials come from assuming a role or from access keys.
        awsSecretKey:
          type: string
          description: AWS secret access key when using manual authentication.
        bucketPathSuggestion:
          type: string
          description: Default bucket path pattern suggested when creating or extending
            Dataset paths in the UI.
        enableAbacTagging:
          type: boolean
          description: If <code>true</code>, apply ABAC source-IP tagging to allow for
            more restrictive assumed-role trust and permission policies. See <a
            href="https://docs.cribl.io/search/aws-access/#trust-vpce">Cribl
            docs</a>.
        enableAssumeRole:
          type: boolean
          description: If <code>true</code>, use STS assume-role instead of static keys.
        endpoint:
          type: string
          description: Custom S3-compatible endpoint URL; omit to use the default AWS
            endpoint for the region.
        rejectUnauthorized:
          type: boolean
          description: If <code>true</code>, reject certificates that cannot be verified
            against a valid Certificate Authority (CA), such as self-signed
            certificates. Setting this to <code>false</code> is not recommended.
        reuseConnections:
          type: boolean
          description: If <code>true</code>, reuse HTTP connections to the endpoint where
            supported.
        sessionToken:
          type: string
          description: Temporary session token for short-lived credentials intended for
            development only.
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - id
    DatasetProviderSnowflake:
      type: object
      properties:
        type:
          type: string
          const: snowflake
        accountIdentifier:
          type: string
          description: Snowflake account locator (account identifier) for REST sessions.
          minLength: 1
        endpoint:
          type: string
          description: Optional Snowflake REST API hostname override; omit to use the
            default for the account region.
        maxConcurrency:
          type: integer
          description: Maximum concurrent tasks used while scanning Snowflake partitions
            for this provider.
          minimum: 1
        passphrase:
          type: string
          description: Passphrase that decrypts the private key when it is encrypted on
            disk.
        privKey:
          type: string
          description: PEM text for the private key used with Snowflake key-pair
            authentication.
          minLength: 1
        username:
          type: string
          description: Snowflake user name associated with the key pair authentication.
          minLength: 1
        description:
          type: string
          description: Brief description of the Dataset Provider.
        id:
          type: string
          description: Unique identifier for the Dataset Provider.
        preprocessorBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker applied when preprocessing data from Lake
            Datasets.
      required:
        - type
        - accountIdentifier
        - privKey
        - username
        - id
    DatasetProvider:
      oneOf:
        - $ref: "#/components/schemas/DatasetProviderAmazonSecurityLake"
        - $ref: "#/components/schemas/DatasetProviderApiAws"
        - $ref: "#/components/schemas/DatasetProviderApiAzure"
        - $ref: "#/components/schemas/DatasetProviderApiAzureDataExplorer"
        - $ref: "#/components/schemas/DatasetProviderApiElasticsearch"
        - $ref: "#/components/schemas/DatasetProviderApiGcp"
        - $ref: "#/components/schemas/DatasetProviderApiGoogleWorkspace"
        - $ref: "#/components/schemas/DatasetProviderApiHttp"
        - $ref: "#/components/schemas/DatasetProviderApiLogAnalytics"
        - $ref: "#/components/schemas/DatasetProviderApiMsgraph"
        - $ref: "#/components/schemas/DatasetProviderApiOkta"
        - $ref: "#/components/schemas/DatasetProviderApiOpensearch"
        - $ref: "#/components/schemas/DatasetProviderApiTailscale"
        - $ref: "#/components/schemas/DatasetProviderApiZoom"
        - $ref: "#/components/schemas/DatasetProviderAzureBlob"
        - $ref: "#/components/schemas/DatasetProviderClickhouse"
        - $ref: "#/components/schemas/DatasetProviderCriblEdge"
        - $ref: "#/components/schemas/DatasetProviderCriblLake"
        - $ref: "#/components/schemas/DatasetProviderCriblLeader"
        - $ref: "#/components/schemas/DatasetProviderCriblLocal"
        - $ref: "#/components/schemas/DatasetProviderCriblMeta"
        - $ref: "#/components/schemas/DatasetProviderCriblSearch"
        - $ref: "#/components/schemas/DatasetProviderGcs"
        - $ref: "#/components/schemas/DatasetProviderPrometheus"
        - $ref: "#/components/schemas/DatasetProviderS3"
        - $ref: "#/components/schemas/DatasetProviderSnowflake"
      discriminator:
        propertyName: type
        mapping:
          amazon_security_lake: "#/components/schemas/DatasetProviderAmazonSecurityLake"
          api_aws: "#/components/schemas/DatasetProviderApiAws"
          api_azure: "#/components/schemas/DatasetProviderApiAzure"
          api_azure_data_explorer: "#/components/schemas/DatasetProviderApiAzureDataExplorer"
          api_elasticsearch: "#/components/schemas/DatasetProviderApiElasticsearch"
          api_gcp: "#/components/schemas/DatasetProviderApiGcp"
          api_google_workspace: "#/components/schemas/DatasetProviderApiGoogleWorkspace"
          api_http: "#/components/schemas/DatasetProviderApiHttp"
          api_log_analytics: "#/components/schemas/DatasetProviderApiLogAnalytics"
          api_msgraph: "#/components/schemas/DatasetProviderApiMsgraph"
          api_okta: "#/components/schemas/DatasetProviderApiOkta"
          api_opensearch: "#/components/schemas/DatasetProviderApiOpensearch"
          api_tailscale: "#/components/schemas/DatasetProviderApiTailscale"
          api_zoom: "#/components/schemas/DatasetProviderApiZoom"
          azure_blob: "#/components/schemas/DatasetProviderAzureBlob"
          clickhouse: "#/components/schemas/DatasetProviderClickhouse"
          cribl_edge: "#/components/schemas/DatasetProviderCriblEdge"
          cribl_lake: "#/components/schemas/DatasetProviderCriblLake"
          cribl_leader: "#/components/schemas/DatasetProviderCriblLeader"
          cribl_local: "#/components/schemas/DatasetProviderCriblLocal"
          cribl_meta: "#/components/schemas/DatasetProviderCriblMeta"
          cribl_search: "#/components/schemas/DatasetProviderCriblSearch"
          gcs: "#/components/schemas/DatasetProviderGcs"
          prometheus: "#/components/schemas/DatasetProviderPrometheus"
          s3: "#/components/schemas/DatasetProviderS3"
          snowflake: "#/components/schemas/DatasetProviderSnowflake"
    CountedDatasetProvider:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DatasetProvider"
    CountedDatasetProviderDetails:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DatasetProviderDetails"
    DatasetProviderDetails:
      type: object
      properties:
        bucketNames:
          type: array
          items:
            type: string
          description: Amazon Security Lake bucket names. Returned only when the Dataset
            Provider type is <code>amazon_security_lake</code>.
    DatasetAmazonSecurityLake:
      type: object
      properties:
        type:
          type: string
          const: amazon_security_lake
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - id
        - provider
    DatasetApiAws:
      type: object
      properties:
        type:
          type: string
          const: api_aws
        enabledEndpoints:
          type: array
          items:
            type: string
          description: AWS inventory or API endpoints to include when querying this Dataset.
          minItems: 1
        regions:
          type: array
          items:
            type: string
          description: AWS regions to query for the enabled endpoints.
          minItems: 1
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - enabledEndpoints
        - regions
        - id
        - provider
    DatasetApiAzure:
      type: object
      properties:
        type:
          type: string
          const: api_azure
        enabledEndpoints:
          type: array
          items:
            type: string
            enum:
              - virtualMachines
              - disks
              - networkSecurityGroups
              - webApps
            x-speakeasy-unknown-values: allow
          description: Azure Dataset endpoints to include.
          minItems: 1
        subscriptionIds:
          type: array
          items:
            type: string
          description: Azure subscription identifiers scoped to the Dataset.
          minItems: 1
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - enabledEndpoints
        - subscriptionIds
        - id
        - provider
    DatasetApiAzureDataExplorer:
      type: object
      properties:
        type:
          type: string
          const: api_azure_data_explorer
        cluster:
          type: string
          description: Azure Data Explorer cluster hostname or name.
          minLength: 1
        database:
          type: string
          description: Database name.
          minLength: 1
        location:
          type: string
          description: Azure region code for the cluster.
          minLength: 1
        table:
          type: string
          description: Table name.
          minLength: 1
        timestampField:
          type: string
          description: Column holding event time.
          minLength: 1
        timestampFieldContents:
          $ref: "#/components/schemas/TimestampFieldContentsOptionsDatasetApiAzureDataExp\
            lorer"
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - cluster
        - database
        - location
        - table
        - timestampFieldContents
        - id
        - provider
    DatasetApiElasticsearch:
      type: object
      properties:
        type:
          type: string
          const: api_elasticsearch
        index:
          type: string
          description: Index name.
          minLength: 1
        timestampField:
          type: string
          description: Field that contains the event timestamp.
          minLength: 1
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - index
        - timestampField
        - id
        - provider
    GcpEndpointConfig:
      type: object
      properties:
        endpointName:
          type: string
          enum:
            - v1.disks
            - v1.instances
            - v1.projects.locations.functions
            - v1.securityPolicies
            - v2.projects.locations.functions
          description: Name of the endpoint.
          x-speakeasy-unknown-values: allow
        region:
          type: string
          description: Region name for endpoint if needed.
      required:
        - endpointName
    DatasetApiGcp:
      type: object
      properties:
        type:
          type: string
          const: api_gcp
        endpointConfigs:
          type: array
          items:
            $ref: "#/components/schemas/GcpEndpointConfig"
          description: Configurations for all endpoints included in the dataset.
          minItems: 1
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - endpointConfigs
        - id
        - provider
    DatasetApiGoogleWorkspace:
      type: object
      properties:
        type:
          type: string
          const: api_google_workspace
        enabledEndpoints:
          type: array
          items:
            type: string
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - enabledEndpoints
        - id
        - provider
    DatasetApiHttp:
      type: object
      properties:
        type:
          type: string
          const: api_http
        enabledEndpoints:
          type: array
          items:
            type: string
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - enabledEndpoints
        - id
        - provider
    DatasetApiLogAnalytics:
      type: object
      properties:
        type:
          type: string
          const: api_log_analytics
        table:
          type: string
          description: Table name or KQL query to use as the data source.
          minLength: 1
        timestampField:
          type: string
          description: Column holding event time.
          minLength: 1
        timestampFieldContents:
          $ref: "#/components/schemas/TimestampFieldContentsOptionsDatasetApiAzureDataExp\
            lorer"
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - table
        - id
        - provider
    DatasetApiMsgraph:
      type: object
      properties:
        type:
          type: string
          const: api_msgraph
        enabledEndpoints:
          type: array
          items:
            type: string
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - enabledEndpoints
        - id
        - provider
    DatasetApiOkta:
      type: object
      properties:
        type:
          type: string
          const: api_okta
        enabledEndpoints:
          type: array
          items:
            type: string
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - enabledEndpoints
        - id
        - provider
    DatasetApiOpensearch:
      type: object
      properties:
        type:
          type: string
          const: api_opensearch
        index:
          type: string
          description: Index name.
          minLength: 1
        timestampField:
          type: string
          description: Field that contains the event timestamp.
          minLength: 1
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - index
        - timestampField
        - id
        - provider
    DatasetApiTailscale:
      type: object
      properties:
        type:
          type: string
          const: api_tailscale
        enabledEndpoints:
          type: array
          items:
            type: string
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - enabledEndpoints
        - id
        - provider
    DatasetApiZoom:
      type: object
      properties:
        type:
          type: string
          const: api_zoom
        enabledEndpoints:
          type: array
          items:
            type: string
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - enabledEndpoints
        - id
        - provider
    DatasetAzureBlob:
      type: object
      properties:
        type:
          type: string
          const: azure_blob
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - id
        - provider
    DatasetClickhouse:
      type: object
      properties:
        type:
          type: string
          const: clickhouse
        database:
          type: string
          description: ClickHouse database that contains the table or view.
          minLength: 1
        table:
          type: string
          description: Table name, view name, or SQL query to use as the data source for
            the Dataset.
          minLength: 1
        timestampField:
          type: string
          description: Column that contains the event timestamp.
          minLength: 1
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - table
        - id
        - provider
    PartitioningScheme:
      type:
        - string
        - "null"
      enum:
        - ddss
        - smart_store
        - null
      x-speakeasy-unknown-values: allow
    DatasetCriblEdge:
      type: object
      properties:
        type:
          type: string
          const: cribl_edge
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        fleets:
          type: array
          items:
            type: string
        partitioningScheme:
          $ref: "#/components/schemas/PartitioningScheme"
        path:
          type: string
          description: Root directory or URI prefix to search. Supports environment
            variables and templating.
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - fleets
        - path
        - id
        - provider
    DatasetCriblLake:
      type: object
      properties:
        type:
          type: string
          const: cribl_lake
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - id
        - provider
    FilesystemDatasetProps:
      type: object
      properties:
        filter:
          type: string
          description: Filter expression evaluated against each discovered path.
        path:
          type: string
          description: Root directory or URI prefix to search. Supports environment
            variables and templating.
      required:
        - path
    DatasetCriblLeader:
      type: object
      properties:
        type:
          type: string
          const: cribl_leader
        extraPaths:
          type: array
          items:
            $ref: "#/components/schemas/FilesystemDatasetProps"
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        path:
          type: string
          description: Root directory or URI prefix to search. Supports environment
            variables and templating.
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - path
        - id
        - provider
    DatasetCriblLocal:
      type: object
      properties:
        type:
          type: string
          const: cribl_local
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - id
        - provider
    DatasetCriblMeta:
      type: object
      properties:
        type:
          type: string
          const: cribl_meta
        datasets:
          type: array
          items:
            type: string
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - datasets
        - id
        - provider
    DatasetCriblSearch:
      type: object
      properties:
        type:
          type: string
          const: cribl_search
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - id
        - provider
    GcsPath:
      type: object
      properties:
        bucket:
          type: string
          description: Google Cloud Storage (GCS) bucket name. Supports templating.
          minLength: 1
        filter:
          type: string
          description: Filter expression evaluated against each object path under the
            bucket.
        partitioningScheme:
          $ref: "#/components/schemas/PartitioningScheme"
        region:
          type: string
          description: Google Cloud region where the bucket is located.
      required:
        - bucket
        - region
    DatasetGcs:
      type: object
      properties:
        type:
          type: string
          const: gcs
        bucket:
          type: string
          description: Google Cloud Storage (GCS) bucket name. Supports templating.
          minLength: 1
        extraPaths:
          type: array
          items:
            $ref: "#/components/schemas/GcsPath"
          description: Additional bucket paths included in the Dataset.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        partitioningScheme:
          $ref: "#/components/schemas/PartitioningScheme"
        region:
          type: string
          description: Google Cloud region where the bucket is located.
        skipEventTimeFilter:
          type: boolean
          description: If <code>true</code>, queries use partition boundaries instead of
            per-event timestamps.
        storageClasses:
          type: array
          items:
            type: string
          description: Storage classes to include when listing objects.
          minItems: 1
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - bucket
        - region
        - id
        - provider
    DatasetPrometheus:
      type: object
      properties:
        type:
          type: string
          const: prometheus
        desiredNumDataPoints:
          type: integer
          description: Target number of samples per series.
          minimum: 1
          maximum: 11000
        metricNamePattern:
          type: string
          description: Regular expression filtering metric names.
        stepMode:
          type: string
          enum:
            - exact
            - nearest_unit
          description: The mode to use when calculating step.
          x-speakeasy-unknown-values: allow
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - desiredNumDataPoints
        - stepMode
        - id
        - provider
    DatasetS3:
      type: object
      properties:
        type:
          type: string
          const: s3
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - id
        - provider
    DatasetSnowflake:
      type: object
      properties:
        type:
          type: string
          const: snowflake
        database:
          type: string
          description: Database name in Snowflake.
          minLength: 1
        role:
          type: string
          description: Snowflake role assumed when executing queries for the Dataset.
          minLength: 1
        schema:
          type: string
          description: Schema name in Snowflake.
          minLength: 1
        table:
          type: string
          description: Table, view or SQL query for Snowflake statement.
          minLength: 1
        timestampField:
          type: string
          description: Column that contains the event timestamp.
          minLength: 1
        warehouse:
          type: string
          description: Warehouse name in Snowflake.
          minLength: 1
        breakerRulesets:
          type: array
          items:
            type: string
          description: Event breaker rulesets that are applied when reading events from
            the Dataset.
        cacheConnectionInfo:
          $ref: "#/components/schemas/CacheConnection"
          description: Lakehouse cache connection metadata. Present when the Dataset uses
            an accelerated Lakehouse cache.
        description:
          type: string
          description: Brief description of the Dataset.
        excludeInternalFields:
          type: boolean
          description: When true, internal fields such as are omitted from results,
            timeline generation is skipped, and time-picker filtering is
            ignored.
        filter:
          type: string
          description: Filter expression that is evaluated against each object path to
            determine inclusion.
        id:
          type: string
          description: Unique identifier for the Dataset.
        metadata:
          $ref: "#/components/schemas/DatasetMetadata"
          description: Dataset acceleration and metadata collection configuration.
        provider:
          type: string
          description: Identifier for the Dataset Provider that the Dataset uses.
        searchVersion:
          $ref: "#/components/schemas/SearchVersion"
          description: Search execution version for the Dataset.
        tags:
          type: string
          description: Optional comma-separated tags for organizing and filtering Datasets.
        viewName:
          type: string
          description: Lakehouse cache view name, when applicable.
      required:
        - type
        - table
        - id
        - provider
    Dataset:
      oneOf:
        - $ref: "#/components/schemas/DatasetAmazonSecurityLake"
        - $ref: "#/components/schemas/DatasetApiAws"
        - $ref: "#/components/schemas/DatasetApiAzure"
        - $ref: "#/components/schemas/DatasetApiAzureDataExplorer"
        - $ref: "#/components/schemas/DatasetApiElasticsearch"
        - $ref: "#/components/schemas/DatasetApiGcp"
        - $ref: "#/components/schemas/DatasetApiGoogleWorkspace"
        - $ref: "#/components/schemas/DatasetApiHttp"
        - $ref: "#/components/schemas/DatasetApiLogAnalytics"
        - $ref: "#/components/schemas/DatasetApiMsgraph"
        - $ref: "#/components/schemas/DatasetApiOkta"
        - $ref: "#/components/schemas/DatasetApiOpensearch"
        - $ref: "#/components/schemas/DatasetApiTailscale"
        - $ref: "#/components/schemas/DatasetApiZoom"
        - $ref: "#/components/schemas/DatasetAzureBlob"
        - $ref: "#/components/schemas/DatasetClickhouse"
        - $ref: "#/components/schemas/DatasetCriblEdge"
        - $ref: "#/components/schemas/DatasetCriblLake"
        - $ref: "#/components/schemas/DatasetCriblLeader"
        - $ref: "#/components/schemas/DatasetCriblLocal"
        - $ref: "#/components/schemas/DatasetCriblMeta"
        - $ref: "#/components/schemas/DatasetCriblSearch"
        - $ref: "#/components/schemas/DatasetGcs"
        - $ref: "#/components/schemas/DatasetPrometheus"
        - $ref: "#/components/schemas/DatasetS3"
        - $ref: "#/components/schemas/DatasetSnowflake"
      discriminator:
        propertyName: type
        mapping:
          amazon_security_lake: "#/components/schemas/DatasetAmazonSecurityLake"
          api_aws: "#/components/schemas/DatasetApiAws"
          api_azure: "#/components/schemas/DatasetApiAzure"
          api_azure_data_explorer: "#/components/schemas/DatasetApiAzureDataExplorer"
          api_elasticsearch: "#/components/schemas/DatasetApiElasticsearch"
          api_gcp: "#/components/schemas/DatasetApiGcp"
          api_google_workspace: "#/components/schemas/DatasetApiGoogleWorkspace"
          api_http: "#/components/schemas/DatasetApiHttp"
          api_log_analytics: "#/components/schemas/DatasetApiLogAnalytics"
          api_msgraph: "#/components/schemas/DatasetApiMsgraph"
          api_okta: "#/components/schemas/DatasetApiOkta"
          api_opensearch: "#/components/schemas/DatasetApiOpensearch"
          api_tailscale: "#/components/schemas/DatasetApiTailscale"
          api_zoom: "#/components/schemas/DatasetApiZoom"
          azure_blob: "#/components/schemas/DatasetAzureBlob"
          clickhouse: "#/components/schemas/DatasetClickhouse"
          cribl_edge: "#/components/schemas/DatasetCriblEdge"
          cribl_lake: "#/components/schemas/DatasetCriblLake"
          cribl_leader: "#/components/schemas/DatasetCriblLeader"
          cribl_local: "#/components/schemas/DatasetCriblLocal"
          cribl_meta: "#/components/schemas/DatasetCriblMeta"
          cribl_search: "#/components/schemas/DatasetCriblSearch"
          gcs: "#/components/schemas/DatasetGcs"
          prometheus: "#/components/schemas/DatasetPrometheus"
          s3: "#/components/schemas/DatasetS3"
          snowflake: "#/components/schemas/DatasetSnowflake"
    CountedDataset:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Dataset"
    CountedDatasetEnriched:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DatasetEnriched"
    DatasetFavorite:
      type: object
      properties:
        time:
          type: integer
          description: Timestamp (in Unix time) when the favorite was recorded.
        userId:
          type: string
          description: The <code>id</code> of the user who set the Dataset as a favorite.
      required:
        - time
        - userId
    DatasetEnriched:
      allOf:
        - oneOf:
            - $ref: "#/components/schemas/DatasetAmazonSecurityLake"
            - $ref: "#/components/schemas/DatasetApiAws"
            - $ref: "#/components/schemas/DatasetApiAzure"
            - $ref: "#/components/schemas/DatasetApiAzureDataExplorer"
            - $ref: "#/components/schemas/DatasetApiElasticsearch"
            - $ref: "#/components/schemas/DatasetApiGcp"
            - $ref: "#/components/schemas/DatasetApiGoogleWorkspace"
            - $ref: "#/components/schemas/DatasetApiHttp"
            - $ref: "#/components/schemas/DatasetApiLogAnalytics"
            - $ref: "#/components/schemas/DatasetApiMsgraph"
            - $ref: "#/components/schemas/DatasetApiOkta"
            - $ref: "#/components/schemas/DatasetApiOpensearch"
            - $ref: "#/components/schemas/DatasetApiTailscale"
            - $ref: "#/components/schemas/DatasetApiZoom"
            - $ref: "#/components/schemas/DatasetAzureBlob"
            - $ref: "#/components/schemas/DatasetClickhouse"
            - $ref: "#/components/schemas/DatasetCriblEdge"
            - $ref: "#/components/schemas/DatasetCriblLake"
            - $ref: "#/components/schemas/DatasetCriblLeader"
            - $ref: "#/components/schemas/DatasetCriblLocal"
            - $ref: "#/components/schemas/DatasetCriblMeta"
            - $ref: "#/components/schemas/DatasetCriblSearch"
            - $ref: "#/components/schemas/DatasetGcs"
            - $ref: "#/components/schemas/DatasetPrometheus"
            - $ref: "#/components/schemas/DatasetS3"
            - $ref: "#/components/schemas/DatasetSnowflake"
          discriminator:
            propertyName: type
            mapping:
              amazon_security_lake: "#/components/schemas/DatasetAmazonSecurityLake"
              api_aws: "#/components/schemas/DatasetApiAws"
              api_azure: "#/components/schemas/DatasetApiAzure"
              api_azure_data_explorer: "#/components/schemas/DatasetApiAzureDataExplorer"
              api_elasticsearch: "#/components/schemas/DatasetApiElasticsearch"
              api_gcp: "#/components/schemas/DatasetApiGcp"
              api_google_workspace: "#/components/schemas/DatasetApiGoogleWorkspace"
              api_http: "#/components/schemas/DatasetApiHttp"
              api_log_analytics: "#/components/schemas/DatasetApiLogAnalytics"
              api_msgraph: "#/components/schemas/DatasetApiMsgraph"
              api_okta: "#/components/schemas/DatasetApiOkta"
              api_opensearch: "#/components/schemas/DatasetApiOpensearch"
              api_tailscale: "#/components/schemas/DatasetApiTailscale"
              api_zoom: "#/components/schemas/DatasetApiZoom"
              azure_blob: "#/components/schemas/DatasetAzureBlob"
              clickhouse: "#/components/schemas/DatasetClickhouse"
              cribl_edge: "#/components/schemas/DatasetCriblEdge"
              cribl_lake: "#/components/schemas/DatasetCriblLake"
              cribl_leader: "#/components/schemas/DatasetCriblLeader"
              cribl_local: "#/components/schemas/DatasetCriblLocal"
              cribl_meta: "#/components/schemas/DatasetCriblMeta"
              cribl_search: "#/components/schemas/DatasetCriblSearch"
              gcs: "#/components/schemas/DatasetGcs"
              prometheus: "#/components/schemas/DatasetPrometheus"
              s3: "#/components/schemas/DatasetS3"
              snowflake: "#/components/schemas/DatasetSnowflake"
        - type: object
          properties:
            criblLakeCacheServerId:
              type: string
              description: Identifier for the Cribl Lake cache server that is associated with
                the Dataset, when applicable.
            engine:
              type: string
              description: Identifier for the Lakehouse engine that is linked to the Dataset,
                when applicable.
            engineDeleted:
              type: boolean
              description: If <code>true</code>, the linked Lakehouse engine no longer exists.
            favorites:
              type: array
              items:
                $ref: "#/components/schemas/DatasetFavorite"
              description: Users who marked the Dataset as a favorite, and when.
            lastUsed:
              type: integer
              description: Timestamp (in Unix time) for when the Dataset was last used in
                Search (milliseconds). .
            maxEventTime:
              type: integer
              description: Timestamp (in Unix time) for the latest event in the Dataset
                (milliseconds). Available only for <code>cribl_search</code>
                Datasets.
            minEventTime:
              type: integer
              description: Timestamp (in Unix time) for the earliest event in the Dataset
                (milliseconds). Available only for <code>cribl_search</code>
                Datasets.
            searchCount30d:
              type: integer
              description: Total number of queries against the Dataset in the last 30 days.
                Available only for <code>cribl_search</code> Datasets.
            storageClasses:
              type: array
              items:
                type: string
              description: Storage classes that apply to the Dataset.
            totalByteCount:
              type: integer
              description: Total stored bytes for the Dataset. Available only for
                <code>cribl_search</code> Datasets.
            totalEventCount:
              type: integer
              description: Total number of events in the Dataset. Available only for
                <code>cribl_search</code> Datasets.
    CountedFederatedSearchEngine:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/FederatedSearchEngine"
    FederatedEngineSize:
      type: string
      enum:
        - 3xsmall
        - 2xsmall
        - xsmall
        - small
        - medium
        - large
        - xlarge
        - 2xlarge
        - 3xlarge
        - 4xlarge
        - 5xlarge
        - 6xlarge
        - usage_based
        - subscription
      x-speakeasy-unknown-values: allow
    FederatedSearchEngine:
      type: object
      properties:
        description:
          type: string
          description: Optional human-readable description of the engine configuration.
        engineType:
          type: string
          const: federated
          description: Discriminator selecting between lakehouse Local Search engines and
            federated engines.
        id:
          type: string
          description: Unique identifier.
        tierSize:
          $ref: "#/components/schemas/FederatedEngineSize"
      required:
        - engineType
        - id
        - tierSize
    CountedLocalSearchEngine:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/LocalSearchEngine"
    EngineSize:
      type: string
      enum:
        - 3xsmall
        - 2xsmall
        - xsmall
        - small
        - medium
        - large
        - xlarge
        - 2xlarge
        - 3xlarge
        - 4xlarge
        - 5xlarge
        - 6xlarge
      x-speakeasy-unknown-values: allow
    LocalSearchEngine:
      type: object
      properties:
        activeWorkflow:
          type: string
          enum:
            - provisioning
            - resizing
            - termination
          description: The provisioning workflow that is currently active for the
            lakehouse engine, if any.
          x-speakeasy-unknown-values: allow
        datasets:
          type: array
          items:
            type: string
          description: The <code>id</code> values for Datasets that are linked to the
            lakehouse engine.
        deletionStartedAt:
          type: integer
          description: Timestamp (in Unix time) when deletion was initiated for the
            lakehouse engine (if applicable), in milliseconds.
        description:
          type: string
          description: Brief description of the lakehouse engine.
        effectiveStatus:
          type: string
          enum:
            - blocked
            - delayed
            - failed
            - provisioning
            - ready
            - resizing
            - terminated
          description: Operational status of the lakehouse engine, accounting for both the
            engine and its underlying Worker Group. If the engine is ready but
            the Worker Group is not, reflects the Worker Group status. If the
            engine is not ready, reflects the engine status regardless of the
            Worker Group status.
          x-speakeasy-unknown-values: allow
        engineType:
          type: string
          const: local
          description: Type of engine. For lakehouse engines, always <code>local</code>.
        hasMain:
          type: boolean
          description: If <code>true</code>, the lakehouse engine currently owns the main
            Dataset.
        id:
          type: string
          description: Unique identifier.
        isComputeDeprovisioned:
          type: boolean
          description: If <code>true</code>, compute for the lakehouse engine has been
            deprovisioned after termination.
        isStorageDeprovisioned:
          type: boolean
          description: If <code>true</code>, the storage backing the lakehouse engine has
            been deprovisioned and fully cleaned up after termination.
        lastProvisionedMs:
          type: integer
          description: Timestamp (in Unix time) when the lakehouse engine was last
            provisioned or updated, in milliseconds.
        metricsLastPublishedAt:
          type: integer
          description: Timestamp (in Unix time) when the lakehouse engine metrics were
            last published, in milliseconds.
        status:
          type: string
          enum:
            - failed
            - provisioning
            - ready
            - terminated
            - delayed
            - blocked
            - resizing
          x-speakeasy-unknown-values: allow
        tierSize:
          $ref: "#/components/schemas/EngineSize"
          description: Storage and compute [tier
            size](https://docs.cribl.io/search/engine-setup/#sizes-list) for the
            lakehouse engine. Configuring sizes <code>3xlarge</code>,
            <code>4xlarge</code>,<code>5xlarge</code>, and <code>6xlarge</code>
            requires the <code>cribl_operator</code> role.
      required:
        - engineType
        - id
        - tierSize
      description: "Lakehouse engine: provisioned storage and compute for ingest and
        search."
    CountedDatasetRuleset:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DatasetRuleset"
    DatasetRule:
      type: object
      properties:
        dataset:
          type: string
          description: The <code>id</code> of the target Dataset to route matched events
            to. Required when <code>sendDataTo</code> is
            <code>destinationDataset</code>. Ignored when
            <code>sendDataTo</code> is <code>drop</code>.
        description:
          type: string
          description: Brief description of the rule.
        disabled:
          type: boolean
          description: If <code>true</code>, the rule is ignored for routing.
        extendExpression:
          type: string
          description: KQL-style extend expression to add or transform fields on matched
            events.
        extendExpressionEnabled:
          type: boolean
          description: If <code>true</code>, the <code>extendExpression</code> is applied
            for the rule.
        id:
          type: string
          description: Unique identifier for the rule.
        kustoExpression:
          type: string
          description: Kusto predicate that selects events for this rule.
        name:
          type: string
          description: Display name of the rule.
        sendDataTo:
          type: string
          enum:
            - destinationDataset
            - drop
          description: To send matching events to a Dataset,
            <code>destinationDataset</code>. To drop matching events,
            <code>drop</code>.
          x-speakeasy-unknown-values: allow
      required:
        - id
        - kustoExpression
        - name
      description: Rule that routes matching events to a Dataset, drops them, or
        applies an extend expression.
    DatasetRuleset:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the ruleset.
        rules:
          type: array
          items:
            $ref: "#/components/schemas/DatasetRule"
          description: Ordered rules for routing events to Datasets. The first matching
            rule wins. Each rule can include an extend expression to transform
            matched events.
      required:
        - id
        - rules
      description: Ordered list of dataset rules for Local Search
        (<code>/search/local_search/dataset-rulesets</code>).
    CountedDatatypeRuleset:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DatatypeRuleset"
    DatatypeRule:
      type: object
      properties:
        datatype:
          type: string
          description: Target datatype id for events that match
            <code>kustoExpression</code>.
        description:
          type: string
          description: Brief description of the rule.
        disabled:
          type: boolean
          description: If <code>true</code>, the rule is ignored for routing.
        id:
          type: string
          description: Unique identifier for the rule.
        kustoExpression:
          type: string
          description: Kusto predicate that selects events for this rule.
        name:
          type: string
          description: Display name of the rule.
      required:
        - datatype
        - id
        - kustoExpression
        - name
      description: Rule that assigns a datatype to matching events.
    DatatypeRuleset:
      type: object
      properties:
        id:
          type: string
          description: Ruleset identifier.
        rules:
          type: array
          items:
            $ref: "#/components/schemas/DatatypeRule"
          description: Rules evaluated in order for datatype routing.
      required:
        - id
        - rules
      description: Ordered list of datatype rules for Local Search
        (<code>/search/local_search/datatype-rulesets</code>).
    CountedAppScopeProcess:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AppScopeProcess"
    AppScopeProcessingStatus:
      type:
        - string
        - "null"
      enum:
        - normal
        - attaching
        - attach_failed
        - updating
        - update_failed
        - detaching
        - detached
        - detach_failed
        - null
      x-speakeasy-unknown-values: allow
    AppScopeProcessStatus:
      type:
        - string
        - "null"
      enum:
        - green
        - yellow
        - red
        - null
      x-speakeasy-unknown-values: allow
    AppScopeProcess:
      type: object
      properties:
        cfg:
          $ref: "#/components/schemas/AppscopeConfigWithCustom"
        config_id:
          type: string
        id:
          type: string
        interfaces:
          type: array
          items:
            type: object
            properties:
              config:
                type: string
              connected:
                type: boolean
              name:
                type: string
        lastError:
          type: string
        process:
          type: object
          properties:
            hostPid:
              type: number
            id:
              type: string
            machine_id:
              type: string
            pid:
              type: number
            uuid:
              type: string
          required:
            - pid
        processingStatus:
          $ref: "#/components/schemas/AppScopeProcessingStatus"
        source_id:
          type: string
        status:
          $ref: "#/components/schemas/AppScopeProcessStatus"
      required:
        - id
    CountedEdgeSourceCollectorInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/EdgeSourceCollectorInfo"
    EdgeCollectorInfo:
      type: object
      properties:
        enable:
          type: boolean
        name:
          type: string
      required:
        - enable
        - name
    EdgeSourceCollectorInfo:
      type: object
      properties:
        collectors:
          type: array
          items:
            $ref: "#/components/schemas/EdgeCollectorInfo"
        source:
          type: string
      required:
        - source
    CountedSourceEventsQueryResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SourceEventsQueryResult"
    SourceEventsQueryResult:
      type: object
      properties:
        endOfResults:
          type: boolean
        events:
          type: array
          items:
            type: object
            additionalProperties: true
        offset:
          type: array
          items:
            type: string
      required:
        - endOfResults
        - events
        - offset
    CountedEdgeFileInspectResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/EdgeFileInspectResponse"
    EdgeFileInspectResponse:
      type: object
      additionalProperties:
        type: string
    CountedFilesystemEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/FilesystemEntry"
    SymLinkInfo:
      type: object
      properties:
        symLinkTarget:
          type: string
        symLinkTargetAbsolutePath:
          type: string
        symLinkTargetIsDirectory:
          type: boolean
        symLinkTargetIsFile:
          type: boolean
      required:
        - symLinkTarget
        - symLinkTargetAbsolutePath
    FilesystemEntry:
      type: object
      properties:
        mode:
          type: string
        name:
          type: string
        stats:
          type: object
          additionalProperties: true
        symLinkInfo:
          $ref: "#/components/schemas/SymLinkInfo"
        type:
          type: string
      required:
        - name
        - type
    CountedEdgeMapQueryResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/EdgeMapQueryResult"
    EdgeMapQueryResult:
      type: object
      additionalProperties: true
      properties:
        __worker_info:
          type: object
          properties:
            hostname:
              type: string
          required:
            - hostname
        __worker_node:
          type: string
      required:
        - __worker_info
        - __worker_node
    CountedMetadata:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Metadata"
    CountedSampleFile:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SampleFile"
    SampleFile:
      type: object
      properties:
        bytes:
          type: string
        bytesRead:
          type: number
        length:
          type: number
      required:
        - bytes
        - bytesRead
        - length
    ContainerRuntimeType:
      type: string
      enum:
        - containerd
        - docker
      x-speakeasy-unknown-values: allow
    CountedContainer:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Container"
    ContainerdMount:
      type: object
      properties:
        destination:
          type: string
        source:
          type: string
      required:
        - destination
        - source
    ContainerdRoot:
      type: object
      properties:
        path:
          type: string
      required:
        - path
    ContainerdContainer:
      type: object
      additionalProperties: true
      properties:
        mounts:
          type: array
          items:
            $ref: "#/components/schemas/ContainerdMount"
        root:
          $ref: "#/components/schemas/ContainerdRoot"
      required:
        - mounts
        - root
    ContainerdTask:
      type: object
      additionalProperties: true
      properties:
        process:
          type: object
          additionalProperties: true
    ContainerdInfo:
      type: object
      properties:
        container:
          $ref: "#/components/schemas/ContainerdContainer"
        image:
          type: object
          additionalProperties: true
        metrics:
          type: object
          additionalProperties: true
        namespace:
          type: object
          additionalProperties: true
        task:
          $ref: "#/components/schemas/ContainerdTask"
      required:
        - container
    DockerGraphDriverData:
      type: object
      properties:
        MergedDir:
          type: string
      required:
        - MergedDir
    DockerGraphDriver:
      type: object
      additionalProperties: true
      properties:
        Data:
          $ref: "#/components/schemas/DockerGraphDriverData"
    DockerMount:
      type: object
      properties:
        Destination:
          type: string
        Source:
          type: string
      required:
        - Destination
        - Source
    DockerInfo:
      type: object
      additionalProperties: true
      properties:
        Config:
          type: object
          additionalProperties: true
        GraphDriver:
          $ref: "#/components/schemas/DockerGraphDriver"
        LogPath:
          type: string
        Mounts:
          type: array
          items:
            $ref: "#/components/schemas/DockerMount"
        NetworkSettings:
          type: object
          additionalProperties: true
        Path:
          type: string
        State:
          type: object
          additionalProperties: true
        Stats:
          type: object
          additionalProperties: true
    ContainerPort:
      type: object
      properties:
        privatePort:
          type: number
        publicPort:
          type: number
      required:
        - privatePort
        - publicPort
    Container:
      type: object
      properties:
        command:
          $ref: "#/components/schemas/ScalarOrArray"
        containerd:
          $ref: "#/components/schemas/ContainerdInfo"
        created:
          type: number
        docker:
          $ref: "#/components/schemas/DockerInfo"
        id:
          type: string
        image:
          type: string
        ips:
          type: array
          items:
            type: string
        name:
          type: string
        ports:
          type: array
          items:
            $ref: "#/components/schemas/ContainerPort"
        status:
          type: string
        type:
          type: string
          enum:
            - docker
            - containerd
          x-speakeasy-unknown-values: allow
      required:
        - command
        - created
        - id
        - image
        - name
        - status
        - type
    EdgeLogDiscoveryMode:
      type: string
      enum:
        - auto
        - manual
      x-speakeasy-unknown-values: allow
    CountedEdgeFile:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/EdgeFile"
    FileProcessInfo:
      type: object
      properties:
        pid:
          type: number
        process:
          type: string
      required:
        - pid
        - process
    EdgeFile:
      type: object
      additionalProperties: true
      properties:
        filePath:
          type: string
        id:
          type: string
        modTime:
          type: number
        mode:
          type: string
        owner:
          type: number
        processInfo:
          type: array
          items:
            $ref: "#/components/schemas/FileProcessInfo"
        size:
          type: number
      required:
        - filePath
        - id
        - modTime
        - mode
        - owner
        - size
    CountedProcess:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Process"
    Process:
      type: object
      properties:
        id:
          type: string
        pid:
          type: number
        ppid:
          type: number
      required:
        - id
        - pid
        - ppid
    CountedApiCredential:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ApiCredential"
    ApiCredential:
      type: object
      properties:
        cloudMetadata:
          $ref: "#/components/schemas/CloudMetadata"
          description: Cloud-specific metadata for the user account.
        disabled:
          type: boolean
          description: If <code>true</code>, the account is disabled and cannot
            authenticate.
        email:
          type: string
          description: Email address associated with the account.
        first:
          type: string
          description: First name of the account holder.
        id:
          type: string
          description: Unique identifier for the account. For API Credential accounts, the
            <code>id</code> value ends with <code>@clients</code>.
        last:
          type: string
          description: Last name of the account holder.
        password:
          type: string
          description: Account password. Omitted from responses.
        roles:
          type: array
          items:
            type: string
          description: Role <code>id</code> values assigned to the account. Each entry
            must match a Role defined on the deployment. Built-in IDs match the
            string values in the <code>DEFAULT_ROLES</code> export in the RBAC
            module (product roles, group and lake RBAC roles, and defaults such
            as <code>admin</code> and <code>user</code>). Custom Role
            <code>id</code> values from the List Roles API are also valid.
        type:
          type: string
          const: credential
          description: Account type. Always <code>credential</code> for API Credentials.
        username:
          type: string
          description: Name for the account.
        workspaceRoles:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeUserWorkspaceRoles"
          description: Cloud-specific mapping of cloud workspace IDs to the role IDs
            assigned in each workspace.
      required:
        - disabled
        - email
        - first
        - id
        - last
        - type
        - username
    ApiCredentialUpdate:
      type: object
      properties:
        roles:
          type: array
          items:
            type: string
          description: Role <code>id</code> values to assign to the API Credential. Each
            entry must match a Role defined on the deployment. Built-in IDs
            match the string values in the <code>DEFAULT_ROLES</code> export in
            the RBAC module (product roles, group and lake RBAC roles, and
            defaults such as <code>admin</code> and <code>user</code>). Custom
            Role <code>id</code> values from the List Roles API are also valid.
      required:
        - roles
    CountedAppInstallInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AppInstallInfo"
    AppInstallWarnings:
      type: array
      items:
        type: string
      description: Install-time warnings returned for App installation, such as
        deprecation notices.
    AppInstallInfo:
      type: object
      properties:
        author:
          type: string
          description: Author of the App.
        description:
          type: string
          description: Brief description of the App.
        displayName:
          type: string
          description: Human-readable display name for the App.
        id:
          type: string
          description: Unique identifier of the App.
        source:
          type: string
          description: "Source for the App installation: URL, <code>git+</code>URL
            reference, or staged file path."
        spec:
          type: string
          description: Version specification used during installation.
        version:
          type: string
          description: Semantic version of the installed App.
        warnings:
          $ref: "#/components/schemas/AppInstallWarnings"
          description: Warnings generated during App installation.
      required:
        - id
        - source
      description: Result for App installation, including any warnings.
    AppRequestBody:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the App. When provided with
            <code>source</code>, overrides the <code>id</code> that is listed in
            the package.json for the App.
        spec:
          type: string
          description: Schema spec version for the app.
        version:
          type: string
          description: Semantic version of the app.
        minLogStreamVersion:
          type: string
          description: Minimum Cribl Stream version required by this app.
        displayName:
          type: string
          description: Human-readable display name for the app.
        author:
          type: string
          description: Author of the app.
        description:
          type: string
          description: Brief description of the app.
        source:
          type: string
          description: "The source of the app: a URL, uploaded filename, or
            <code>git+</code>URL. If omitted, the request creates an empty App."
        cribl:
          type: object
          properties:
            type:
              type: string
              enum:
                - app
              description: Cribl package type. Always "app" for apps.
              x-speakeasy-unknown-values: allow
            createAppScriptVersion:
              type: string
              description: Version of the create-app scaffold that generated this app.
        force:
          type: boolean
          description: If <code>true</code>, overwrite any existing App that has the same
            <code>id</code>. If <code>false</code>, and an App with the same
            <code>id</code> already exists, the request fails.
    CountedAppDeleteInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AppDeleteInfo"
    AppDeleteInfo:
      type: object
      properties:
        id:
          type: string
      required:
        - id
    CountedAppInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AppInfo"
    AppInfo:
      type: object
      properties:
        author:
          type: string
          description: Author of the App.
        cribl:
          type: object
          properties:
            createAppScriptVersion:
              type: string
              description: Version of the create-app scaffold that generated this App.
            isPrivate:
              type: boolean
              description: When <code>true</code>, the app is visible only to users with an
                explicit AppUser ACL grant.
            type:
              type: string
              const: app
              description: Cribl package type. Always <code>app</code> for Apps.
          description: Cribl package metadata.
        description:
          type: string
          description: Brief description of the App.
        displayName:
          type: string
          description: Human-readable display name for the App.
        id:
          type: string
          description: Unique identifier.
        minLogStreamVersion:
          type: string
          description: Minimum compatible Cribl Stream version.
        source:
          type: string
          description: "Source for the App installation: URL, <code>git+</code>URL
            reference, or staged file path."
        spec:
          type: string
          description: Version specification used during installation.
        version:
          type: string
          description: Semantic version of the App.
      required:
        - id
      description: App record returned by list and detail endpoints.
    CountedAuthPolicyEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AuthPolicyEntry"
    AuthPolicyEntry:
      type: object
      properties:
        actions:
          type: array
          items:
            type: string
        object:
          type: string
      required:
        - actions
        - object
    CountedAppProxyConfigEntity:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AppProxyConfigEntity"
    AppProxyConfigEntity:
      type: object
      properties:
        headers:
          $ref: "#/components/schemas/HeadersTypeAppProxyConfigEntity"
        paths:
          $ref: "#/components/schemas/PathsTypeAppProxyConfigEntity"
        rejectUnauthorized:
          type: boolean
          description: If <code>false</code>, accept self-signed or untrusted TLS
            certificates. Default is <code>true</code>.
        timeout:
          type: number
          description: Timeout in milliseconds for proxied requests to the external
            service. Minimum <code>1000</code>, maximum <code>120000</code>,
            default <code>30000</code>.
        id:
          type: string
          description: Unique identifier.
      required:
        - id
    CountedAppPreinstallCheckResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AppPreinstallCheckResult"
    AppProxiesConfig:
      type: object
      additionalProperties:
        type: object
        properties:
          headers:
            $ref: "#/components/schemas/HeadersTypeAppProxyConfigEntity"
          paths:
            $ref: "#/components/schemas/PathsTypeAppProxyConfigEntity"
          rejectUnauthorized:
            type: boolean
            description: If <code>false</code>, accept self-signed or untrusted TLS
              certificates. Default is <code>true</code>.
          timeout:
            type: number
            description: Timeout in milliseconds for proxied requests to the external
              service. Minimum <code>1000</code>, maximum <code>120000</code>,
              default <code>30000</code>.
        description: Configuration for a single proxy domain declared in
          <code>proxies.yml</code> for the App.
      description: Root <code>proxies.yml</code> configuration. Top-level keys are
        domain names.
      title: AppProxiesConfig
    AppPreinstallCheckResult:
      type: object
      properties:
        dangerousFileTypes:
          type: array
          items:
            type: string
          description: Relative paths of files in the App whose extensions match a
            blocklist of dangerous types (binaries, scripts, installers, etc.).
            Empty when no such files are present. The UI should surface these to
            the user before allowing the install or upgrade to proceed.
        policies:
          type: array
          items:
            $ref: "#/components/schemas/AuthPolicyEntry"
          description: Policy entries declared in the App's <code>policies.yml</code>.
            Empty array when the file is absent or empty. Allows admins to
            review the policy rules an App ships with before installing it.
            Omitted entirely when App RBAC is disabled.
        proxies:
          oneOf:
            - type: "null"
            - $ref: "#/components/schemas/AppProxiesConfig"
          description: Parsed contents of the App's <code>proxies.yml</code>, or
            <code>null</code> when the App declares no external proxy domains.
      required:
        - dangerousFileTypes
        - proxies
      description: Response body for the App preinstall check endpoint.
        <code>default/proxies.yml</code> and <code>default/policies.yml</code>
        are inspected; <code>package.json</code> is not read.
    AppPreinstallCheckRequest:
      type: object
      properties:
        source:
          type: string
          description: Staged upload filename, HTTPS URL, or <code>git+</code> URL—the
            same <code>source</code> formats accepted by <code>POST
            /apps</code>.
        spec:
          type: string
          description: Branch, tag, or commit to check out when <code>source</code> is a
            <code>git+</code> URL. Omit to use the repository's default branch.
            Must match the <code>spec</code> you intend to pass to the install
            or upgrade call.
      required:
        - source
      description: Request body for the App preinstall check endpoint (<code>POST
        /apps/preinstall-check</code>).
    AppUpgradeRequest:
      type: object
      properties:
        minor:
          type: string
          description: If <code>"true"</code>, limit upgrade to minor version only.
        source:
          type: string
          description: "Source for the new App version: URL, <code>git+</code>URL
            reference, or staged file path."
        spec:
          type: string
          description: Version specification for the upgrade.
      required:
        - source
      description: Request body for upgrading an App.
    AppUploadResponse:
      type: object
      properties:
        source:
          type: string
          description: Identifier for the staged App file to use as the value for the
            <code>source</code> body parameter in a <code>POST /apps</code>
            request to install the App.
      required:
        - source
      description: Response body for the request to upload an App file.
    CountedCrudEntityBase:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/CrudEntityBase"
    CrudEntityBase:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier.
      required:
        - id
    CountedMultiFactorAuthSchema:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/MultiFactorAuthSchema"
    MultiFactorAuthSchema:
      type: object
      properties:
        accessControlAllowOrigin:
          type: string
        allowLogin:
          type: boolean
        apiServerUrl:
          type: string
        disabled:
          type: boolean
        type:
          type: string
          const: piv
        usernameField:
          type: string
        usernameRegex:
          type: string
      required:
        - accessControlAllowOrigin
        - allowLogin
        - apiServerUrl
        - disabled
        - type
        - usernameField
        - usernameRegex
    CountedSuccessResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SuccessResponse"
    SuccessResponse:
      type: object
      properties:
        success:
          type: boolean
          const: true
      required:
        - success
    SamlCallbackBody:
      type: object
      properties:
        RelayState:
          type: string
        SAMLResponse:
          type: string
      required:
        - SAMLResponse
    AuthToken:
      type: object
      properties:
        forcePasswordChange:
          type: boolean
        token:
          type: string
      required:
        - forcePasswordChange
        - token
    LoginInfo:
      type: object
      properties:
        password:
          type: string
        username:
          type: string
      required:
        - password
        - username
    LogoutResponse:
      type: object
      properties:
        success:
          type: boolean
          const: true
        redirectUrl:
          type: string
    SSORedirectInfoResponse:
      type: object
      properties:
        allowLocalAuth:
          type: boolean
        name:
          type: string
        redirectUrl:
          type: string
        saasRedirect:
          type: string
        token:
          type: string
        username:
          type: string
    CapturedEvent:
      type: object
      additionalProperties: true
      properties:
        _raw:
          type: string
          description: Raw event data.
        _time:
          type: number
          description: Timestamp of the event.
    CaptureLevel:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 3
      description: Stage at which events are captured. <br><code>0</code> == Before
        pre-processing Pipeline <br><code>1</code> == Before the Routes
        <br><code>2</code> == Before post-processing Pipeline <br><code>3</code>
        == Before the Destination.
      x-speakeasy-enum-descriptions:
        - 1. Before pre-processing Pipeline
        - 2. Before the Routes
        - 3. Before post-processing Pipeline
        - 4. Before the Destination
      x-speakeasy-enums:
        - BeforePreProcessingPipeline
        - BeforeRoutes
        - BeforePostProcessingPipeline
        - BeforeDestination
      x-speakeasy-unknown-values: allow
    CaptureParamsReq:
      type: object
      properties:
        duration:
          type: integer
          description: Amount of time to keep capture open, in seconds. If not provided,
            the default is 5 seconds.
          minimum: 1
        filter:
          type: string
          description: JavaScript expression evaluated against each event to determine
            whether an event is included in the capture output. Expressions can
            reference any event field and use logical operators. If not
            provided, all events are captured.
        level:
          $ref: "#/components/schemas/CaptureLevel"
          description: Stage at which events are captured. If not provided, the default is
            0.
          minimum: 0
          maximum: 3
        maxEvents:
          type: integer
          description: Maximum number of events to capture. If not provided, the default
            is 100.
          minimum: 1
          maximum: 10000
        stepDuration:
          type: integer
          description: How long to wait before increasing the capture sample size. Specify
            <code>1</code> second or longer. If not provided, the default is 5
            seconds.
        workerId:
          type: string
          description: Unique ID of the Worker.
        workerThreshold:
          type: integer
          description: Maximum number of Workers that can capture initially. A value of
            <code>0</code> means unlimited (all available Workers can capture).
            If not provided, the default is 50.
    CountedChangelogState:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ChangelogState"
    ChangelogState:
      type: object
      properties:
        lastViewedCurrent:
          type: string
        lastViewedUpgrade:
          type: string
    CountedClickHouseDescriptionResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ClickHouseDescriptionResult"
    ClickHouseDescriptionColumn:
      type: object
      properties:
        name:
          type: string
          description: Name of the column.
        type:
          type: string
          description: Data type of the column.
      required:
        - name
        - type
      description: Key-value pairs that each identify the name and type for a single
        column in a ClickHouse table.
    ClickHouseDescriptionResult:
      type: object
      properties:
        description:
          type: array
          items:
            $ref: "#/components/schemas/ClickHouseDescriptionColumn"
          description: List of columns and their types in the ClickHouse table.
        errorMsg:
          type: string
          description: The error message returned if the request to describe the
            ClickHouse table failed.
        success:
          type: boolean
          description: If <code>true</code>, the request to describe the ClickHouse table
            succeeded.
      required:
        - success
      description: ClickHouse table description.
    TLSClientParams:
      type: object
      properties:
        caPath:
          type: string
          description: Path to the Certificate Authority (CA) certificate file in PEM
            format.
        certPath:
          type: string
          description: Path to the client certificate file in PEM format.
        disabled:
          type: boolean
          description: If <code>true</code>, TLS is disabled for the connection.
        maxVersion:
          $ref: "#/components/schemas/SecureVersion"
          description: Maximum TLS version to allow for the connection.
        minVersion:
          $ref: "#/components/schemas/SecureVersion"
          description: Minimum TLS version to allow for the connection.
        passphrase:
          type: string
          description: Passphrase for the private key.
        privKeyPath:
          type: string
          description: Path to the private key file in PEM format.
        rejectUnauthorized:
          type: boolean
          description: If <code>true</code>, reject connections to servers with unverified
            TLS certificates.
        servername:
          type: string
          description: Server name for TLS Server Name Indication (SNI) extension.
      required:
        - disabled
      description: TLS client connection settings.
    ClickHouseDescriptionRequest:
      type: object
      properties:
        auth:
          type: object
          properties:
            disabled:
              type: boolean
              description: If <code>true</code>, authentication is disabled.
            password:
              type: string
              description: Password for <code>token</code> authentication.
            token:
              type: string
              description: Bearer token to send in the Authorization header when making HTTP
                requests to the ClickHouse server for <code>token</code>
                authentication.
            username:
              type: string
              description: Username for <code>token</code> authentication.
          description: Settings for <code>token</code> authentication.
        authType:
          type: string
          description: "Authentication method to use for the connection.<br/><br/>
            <code>none</code>: No authentication. <br/> <code>basic</code>:
            Username and password credentials. <br/>
            <code>credentialsSecret</code>: Reference to a secret that stores
            username and password credentials. <br/>
            <code>sslUserCertificate</code>: Client certificate authentication.
            Requires <code>sqlUsername</code>."
        columnMappings:
          type: array
          items:
            type: object
            properties:
              columnName:
                type: string
                description: Name of the ClickHouse column.
              columnType:
                type: string
                description: Data type of the ClickHouse column.
              columnValueExpression:
                type: string
                description: JavaScript expression that produces the value for the column.
            required:
              - columnName
              - columnType
              - columnValueExpression
          description: Custom definitions for mapping event fields to ClickHouse columns.
        database:
          type: string
          description: Name of the ClickHouse database where the target table resides.
        password:
          type: string
          description: Password for <code>basic</code> authentication.
        rejectUnauthorized:
          type: boolean
          description: If <code>true</code>, reject connections with unauthorized TLS
            certificates.
        sqlUsername:
          type: string
          description: Username for <code>sslUserCertificate</code> authentication.
        tableName:
          type: string
          description: Name of the ClickHouse table to describe.
        timeoutSec:
          type: integer
          description: Maximum time to wait for the ClickHouse table description request
            to complete, in seconds.
        tls:
          $ref: "#/components/schemas/TLSClientParams"
          description: TLS configuration for the connection.
        url:
          type: string
          description: URL of the server for the ClickHouse instance.
        username:
          type: string
          description: Username for <code>basic</code> authentication.
      required:
        - database
        - tableName
        - url
      description: Request body for describing a ClickHouse table, including
        connection and authentication details.
    CountedCluiItem:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/CluiItem"
    CluiType:
      type: string
      enum:
        - input
        - output
        - route
        - pipeline
        - knowledge
        - collector
        - pack
        - monitoring
        - monitor
      x-speakeasy-unknown-values: allow
    CluiItem:
      type: object
      properties:
        category:
          type: string
          const: link
        groupId:
          type: string
        id:
          type: string
        name:
          type: string
        packId:
          type: string
        subType:
          type: string
        type:
          $ref: "#/components/schemas/CluiType"
      required:
        - category
        - type
    CountedNumber:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            type: number
    CountedMasterWorkerEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/MasterWorkerEntry"
    ConnectionProtocol:
      type: string
      enum:
        - tcp
        - tls
        - http2
      x-speakeasy-unknown-values: allow
    ApiScheme:
      type: string
      enum:
        - http
        - https
      x-speakeasy-unknown-values: allow
    LookupVersions:
      type: object
      additionalProperties:
        type: object
        additionalProperties:
          type: string
      description: Objects that map Lookup files to deployment versions.
    HBLeaderInfo:
      type: object
      properties:
        host:
          type: string
          description: Leader hostname or IP address.
        port:
          type: integer
          description: Leader TCP port.
        servername:
          type: string
          description: TLS server name (SNI) for the Leader connection.
        tls:
          type: boolean
          description: If <code>true</code>, TLS is enabled for the Leader connection.
      required:
        - host
        - port
      description: Connection parameters for the Leader Node, as reported in a Worker
        heartbeat.
    HBCriblInfo:
      type: object
      properties:
        config:
          type: object
          properties:
            featuresRev:
              type: string
              description: Feature flags or feature revision string for the bundle.
            hbPeriodSeconds:
              type: integer
              description: Worker-to-Leader heartbeat interval, in seconds.
            logStreamEnv:
              type: string
              description: GitOps or LogStream environment label associated with the bundle.
            policyRev:
              type: string
              description: Current policies revision string.
            usersRev:
              type: string
              description: Current users revision string. Only used in leader <> leader
                universal subscription.
            version:
              type: string
              description: Configuration bundle version.
          description: Configuration bundle and policy revision metadata for the node.
        deploymentId:
          type: string
          description: Unique identifier for the deployment assigned for the node.
        disableSNIRouting:
          type: boolean
          description: If <code>true</code>, SNI-based routing to the Leader is disabled
            for the connection.
        distMode:
          type: string
          enum:
            - edge
            - managed-edge
            - master
            - outpost
            - search-supervisor
            - single
            - worker
          description: Distributed deployment mode for the instance.
          examples:
            - worker
            - managed-edge
            - master
          x-speakeasy-unknown-values: allow
        edgeNodes:
          type: integer
          description: Count of Edge nodes reported in the Leader heartbeat.
        group:
          type: string
          description: Worker Group or Edge Fleet name.
        guid:
          type: string
          description: Unique instance identifier for the Cribl node.
        installType:
          type: string
          description: Value of the <code>CRIBL_INSTALL_TYPE</code> environment variable,
            relayed for upgrade decisions (since 4.5.0).
        lookupVersions:
          $ref: "#/components/schemas/LookupVersions"
          description: Deployed Lookup file names and their deployed versions by context.
        master:
          $ref: "#/components/schemas/HBLeaderInfo"
          description: Leader connection details when the node is a Worker or Edge
            reporting upstream.
        overlayId:
          type: string
        pid:
          type: integer
          description: The process ID.
        socksEnabled:
          type: boolean
          description: If <code>true</code>, SOCKS proxy connectivity is enabled for the
            node.
        startTime:
          type: integer
          description: Timestamp (in Unix time) when the Cribl server process started, in
            milliseconds.
        tags:
          type: array
          items:
            type: string
          description: Tags from the node.
        version:
          type: string
          description: Cribl software version string for the node.
      required:
        - config
        - distMode
        - group
        - guid
        - startTime
    HeartbeatMetadata:
      type: object
      properties:
        aws:
          $ref: "#/components/schemas/AwsTypeHeartbeatMetadata"
        azure:
          $ref: "#/components/schemas/AzureTypeHeartbeatMetadata"
        hostOs:
          $ref: "#/components/schemas/HostOsTypeHeartbeatMetadata"
        kube:
          $ref: "#/components/schemas/KubeTypeHeartbeatMetadata"
        os:
          $ref: "#/components/schemas/HostOsTypeHeartbeatMetadata"
    OutpostNodeInfo:
      type: object
      properties:
        groupname:
          type: string
        guid:
          type: string
        host:
          type: string
      required:
        - guid
        - host
    NodeProvidedInfo:
      type: object
      properties:
        apiPort:
          type: number
        apiScheme:
          $ref: "#/components/schemas/ApiScheme"
        architecture:
          type: string
        aws:
          $ref: "#/components/schemas/AwsTypeHeartbeatMetadata"
        azure:
          $ref: "#/components/schemas/AzureTypeHeartbeatMetadata"
        conn_ip:
          type: string
        cpus:
          type: number
        cribl:
          $ref: "#/components/schemas/HBCriblInfo"
        env:
          type: object
          additionalProperties:
            type: string
        freeDiskSpace:
          type: number
        hostOs:
          $ref: "#/components/schemas/HostOsTypeHeartbeatMetadata"
        hostname:
          type: string
        isCaptain:
          type: boolean
        isSaasWorker:
          type: boolean
        kube:
          $ref: "#/components/schemas/KubeTypeHeartbeatMetadata"
        localTime:
          type: number
        metadata:
          $ref: "#/components/schemas/HeartbeatMetadata"
        node:
          type: string
        os:
          oneOf:
            - $ref: "#/components/schemas/HostOsTypeHeartbeatMetadata"
            - type: object
              properties:
                addresses:
                  type: array
                  items:
                    type: string
              required:
                - addresses
        outpost:
          $ref: "#/components/schemas/OutpostNodeInfo"
        platform:
          type: string
        release:
          type: string
        totalDiskSpace:
          type: number
        totalmem:
          type: number
      required:
        - architecture
        - cpus
        - cribl
        - env
        - hostname
        - node
        - platform
        - release
        - totalmem
    NodeActiveUpgradeStatus:
      type: integer
      enum:
        - 0
        - 1
        - 2
      x-speakeasy-unknown-values: allow
      x-speakeasy-enums:
        - Pending
        - Queued
        - Upgrading
    NodeFailedUpgradeStatus:
      type: integer
      enum:
        - 0
        - 1
      x-speakeasy-unknown-values: allow
      x-speakeasy-enums:
        - UpgradeErrorOnNode
        - UpgradeInstallationRollback
    NodeSkippedUpgradeStatus:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 3
      x-speakeasy-unknown-values: allow
      x-speakeasy-enums:
        - DownloadError
        - InstallType
        - MissingPackage
        - TooOld
    NodeUpgradeState:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 3
      x-speakeasy-unknown-values: allow
      x-speakeasy-enums:
        - Active
        - Current
        - Failed
        - Skipped
    NodeUpgradeStatus:
      type: object
      properties:
        active:
          $ref: "#/components/schemas/NodeActiveUpgradeStatus"
        failed:
          $ref: "#/components/schemas/NodeFailedUpgradeStatus"
        skipped:
          $ref: "#/components/schemas/NodeSkippedUpgradeStatus"
        state:
          $ref: "#/components/schemas/NodeUpgradeState"
        timestamp:
          type: number
      required:
        - state
        - timestamp
    MasterWorkerEntry:
      type: object
      properties:
        connectionProtocol:
          $ref: "#/components/schemas/ConnectionProtocol"
        deployable:
          type: boolean
        disconnected:
          type: boolean
        firstMsgTime:
          type: number
        group:
          type: string
        id:
          type: string
        info:
          $ref: "#/components/schemas/NodeProvidedInfo"
        lastMetrics:
          type: object
          additionalProperties: true
        lastMsgTime:
          type: number
        metadata:
          $ref: "#/components/schemas/HeartbeatMetadata"
        nodeUpgradeStatus:
          $ref: "#/components/schemas/NodeUpgradeStatus"
        provisioningTokenId:
          type: string
        status:
          type: string
        type:
          type: string
          enum:
            - info
            - req
            - resp
          x-speakeasy-unknown-values: allow
        workerProcesses:
          type: number
        workers:
          type: object
          properties:
            count:
              type: number
          required:
            - count
      required:
        - firstMsgTime
        - group
        - id
        - info
        - lastMsgTime
        - workerProcesses
    CountedRestartResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/RestartResponse"
    RestartResponse:
      type: object
      properties:
        id:
          type: string
        message:
          type: string
        status:
          type: string
          enum:
            - Error
            - Restarting
          x-speakeasy-unknown-values: allow
      required:
        - id
        - status
    CountedRotateTokenResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/RotateTokenResponse"
    RotateTokenResult:
      type: object
      properties:
        error:
          type: string
          description: Error message when status is <code>failed</code>. Absent on success.
        failurePhase:
          type: string
          enum:
            - rotation
            - validation
          description: "Present only when <code>status</code> is <code>failed</code>.
            Indicates which phase failed: <code>validation</code> means the node
            is not safe to rotate (fix the node first); <code>rotation</code>
            means the rotation attempt itself failed (retry)."
          x-speakeasy-unknown-values: allow
        guid:
          type: string
          description: ID of the Worker or Edge Node.
        status:
          type: string
          enum:
            - failed
            - success
          description: Rotation result.
          x-speakeasy-unknown-values: allow
      required:
        - guid
        - status
    RotateTokenResponse:
      type: object
      properties:
        dryRun:
          type: boolean
          const: true
          description: Echoed when the request was a dry-run (no rotation was performed).
        results:
          type: array
          items:
            $ref: "#/components/schemas/RotateTokenResult"
          description: Per-node rotation results.
        tokenValidation:
          type: object
          properties:
            error:
              type: string
            valid:
              type: boolean
          required:
            - valid
          description: Provisioning token validation result. Present in dry-run responses
            when provisioningTokenId was supplied.
        totalMatched:
          type: integer
          description: "Total number of matched nodes before truncation. Present only when
            <code>truncated: true</code>."
          minimum: 1
        truncated:
          type: boolean
          description: If <code>true</code>, the result set was truncated due to the
            per-request limit.
      required:
        - results
    RotateTokenBatchGuidsRequest:
      type: object
      properties:
        dryRun:
          type: boolean
          description: When true, perform validation only without executing rotation.
            provisioningTokenId may be omitted.
        guids:
          type: array
          items:
            type: string
          description: List of Worker or Edge Node IDs to target.
          minItems: 1
          maxItems: 1000
        provisioningTokenId:
          type: string
          description: ID of the provisioning token to apply. Omit to generate a per-node
            token (future milestone).
      required:
        - guids
      title: RotateTokenBatchGuidsRequest
    RotateTokenBatchFilterRequest:
      type: object
      properties:
        dryRun:
          type: boolean
          description: When true, perform validation only without executing rotation.
            provisioningTokenId may be omitted.
        filter:
          type: object
          properties:
            group:
              type: string
              description: Worker Group or Edge Fleet name.
          required:
            - group
          description: Filter that selects all nodes in the specified group.
        provisioningTokenId:
          type: string
          description: ID of the provisioning token to apply. Omit to generate a per-node
            token (future milestone).
      required:
        - filter
      title: RotateTokenBatchFilterRequest
    RotateTokenBatchRequest:
      oneOf:
        - $ref: "#/components/schemas/RotateTokenBatchGuidsRequest"
        - $ref: "#/components/schemas/RotateTokenBatchFilterRequest"
    RestartRequest:
      type: object
      properties:
        guids:
          type: array
          items:
            type: string
          description: GUIDs of the Worker or Edge Nodes to restart.
      required:
        - guids
    CountedRotateTokenResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/RotateTokenResult"
    RotateTokenRequest:
      type: object
      properties:
        dryRun:
          type: boolean
          description: When true, perform validation only without executing rotation.
            provisioningTokenId may be omitted.
        provisioningTokenId:
          type: string
          description: ID of the provisioning token to apply. Omit to generate a per-node
            token (future milestone).
    CountedOutpostUpgradeResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/OutpostUpgradeResponse"
    OutpostUpgradeResponse:
      type: object
      properties:
        id:
          type: string
        message:
          type: string
        status:
          type: string
          enum:
            - Error
            - Upgrading
          x-speakeasy-unknown-values: allow
      required:
        - id
        - status
    WorkerTypes:
      type: string
      enum:
        - worker
        - managed-edge
      x-speakeasy-unknown-values: allow
    CountedDistributedSummary:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DistributedSummary"
    DistributedSummary:
      type: object
      properties:
        groups:
          type: object
          properties:
            count:
              type: integer
              description: Total number of Worker Groups or Edge Fleets.
            destinations:
              type: integer
              description: Total number of Destinations.
            packs:
              type: integer
              description: Total number of Packs.
            pipelines:
              type: integer
              description: Total number of Pipelines.
            quickConnects:
              type: integer
              description: Total number of QuickConnect configurations.
            routes:
              type: integer
              description: Total number of Routes.
            sources:
              type: integer
              description: Total number of Sources.
          required:
            - count
            - destinations
            - packs
            - pipelines
            - quickConnects
            - routes
            - sources
        workers:
          type: object
          properties:
            alive:
              type: integer
              description: Total number of Worker or Edge Nodes that are connected with
                <code>healthy</code> status.
            confVersions:
              type: integer
              description: Total number of unique configuration versions across all Worker or
                Edge Nodes.
            count:
              type: integer
              description: Total number of Worker or Edge Nodes.
            disconnectedCount:
              type: integer
              description: Total number of Worker or Edge Nodes in a disconnected state.
            groups:
              type: integer
              description: Total number of distinct Worker Groups or Edge Fleets that the
                Workers or Edge Nodes belong to.
            softwareVersions:
              type: integer
              description: Total number of unique Cribl software versions across all Worker or
                Edge Nodes.
            unhealthy:
              type: integer
              description: Total number of Worker or Edge Nodes that are connected with a
                status other than <code>healthy</code>.
          required:
            - alive
            - confVersions
            - count
            - disconnectedCount
            - groups
            - softwareVersions
            - unhealthy
      required:
        - groups
      description: Summary of the deployment for the specified Cribl product (Stream
        or Edge).
    CountedUpgradeWorkerInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/UpgradeWorkerInfo"
    UpgradeWorkerInfo:
      type: object
      properties:
        guid:
          type: string
        host:
          type: string
        version:
          type: string
      required:
        - guid
        - host
        - version
    DistributedUpgradeRequest:
      type: object
      additionalProperties: false
      properties:
        packageUrls:
          title: Custom Path
          description: Provide your own URLs or local paths for platform-specific Cribl
            packages
          type: array
          items:
            $ref: "#/components/schemas/PackageUrlConfDistributedUpgradeRequest"
        upgradePercentage:
          type: number
          title: Percentage of workers to upgrade
          description: Percentage of the total worker nodes on the group to run the
            upgrade on
          minimum: 0.00001
          maximum: 1
        workerRetries:
          type: number
          title: Worker node connect retry count
          description: Number of times to retry conncecting to a worker node before
            marking the upgrade as failed.
          minimum: 1
        workerRetryDelay:
          type: number
          title: Worker node connect retry delay
          description: Delay between retries
          minimum: 100
        upgradeMode:
          type: string
          title: Upgrade mode
          enum:
            - rolling
            - regular
            - batch
          x-speakeasy-unknown-values: allow
        versionTo:
          type: string
          title: Exact version to match
    CountedExprLibEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ExprLibEntry"
    ExprLibEntry:
      type: object
      properties:
        context:
          type: object
          additionalProperties: true
        evalType:
          type: string
        expr:
          type: string
          description: JavaScript expression to evaluate.
        id:
          type: string
        pack:
          type: string
        result:
          type: object
          additionalProperties: true
        unprotected:
          type: boolean
      required:
        - expr
        - id
    CountedCondition:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Condition"
    ActiveHealthOverlayStatus:
      type: object
      properties:
        binaryVersion:
          type: string
          description: Binary version targeted by the active overlay.
          example: 4.12.0
        overlayId:
          type: string
          description: Active overlay identifier.
          examples:
            - patch.0
            - sideload.a1b2c3d
        state:
          type: string
          const: active
          description: Current overlay state.
          example: active
      required:
        - binaryVersion
        - overlayId
        - state
      title: ActiveHealthOverlayStatus
    NoActiveHealthOverlayStatus:
      type: object
      properties:
        state:
          type: string
          const: inactive
          description: Current overlay state.
          example: inactive
      required:
        - state
      title: NoActiveHealthOverlayStatus
    HealthOverlayStatus:
      oneOf:
        - $ref: "#/components/schemas/ActiveHealthOverlayStatus"
        - $ref: "#/components/schemas/NoActiveHealthOverlayStatus"
    HealthServerStatus:
      type: object
      properties:
        overlay:
          $ref: "#/components/schemas/HealthOverlayStatus"
          description: Overlay state for this process.
        role:
          type: string
          enum:
            - primary
            - standby
          description: "Leader Node role: <code>primary</code> or <code>standby</code>."
          x-speakeasy-unknown-values: allow
        startTime:
          type: integer
          description: Timestamp (in Unix time) when the Cribl process started.
        status:
          type: string
          enum:
            - healthy
            - shutting down
            - standby
          description: "Health state: <code>healthy</code>, <code>standby</code>, or
            <code>shutting down</code>."
          x-speakeasy-unknown-values: allow
      required:
        - overlay
        - startTime
        - status
      description: Health status of the Leader or Worker Node.
    HealthyWorkerStatus:
      type: object
      properties:
        status:
          type: string
          const: healthy
          description: Always <code>healthy</code>.
      required:
        - status
      description: Worker health status when all Worker Processes are up and healthy.
    DownWorkerStatus:
      type: object
      properties:
        status:
          type: string
          const: down
          description: Always <code>down</code>.
      required:
        - status
      description: Worker health status when one or more Workers are down.
    TimeSeriesPoint:
      type: object
      properties:
        endTime:
          type: integer
          description: Timestamp (in Unix time) for the bucket end time, in milliseconds.
            Together with <code>startTime</code>, defines the time range of each
            bucket.
        startTime:
          type: integer
          description: Timestamp (in Unix time) for the bucket start time, in
            milliseconds. Together with <code>endTime</code>, defines the time
            range of each bucket.
        value:
          type: number
          description: Aggregated value for the bucket. May be the event count or byte
            count, depending on the series.
      required:
        - endTime
        - startTime
        - value
      description: A single bucket in a time series histogram.
    TimeSeriesValues:
      type: object
      properties:
        dimensions:
          type: object
          additionalProperties:
            type: string
        name:
          type: string
        points:
          type: array
          items:
            $ref: "#/components/schemas/TimeSeriesPoint"
      required:
        - dimensions
        - name
        - points
    InsightsQueryResponse:
      type: object
      properties:
        timeSeries:
          type: array
          items:
            $ref: "#/components/schemas/TimeSeriesValues"
      required:
        - timeSeries
    TimeSeriesDimensionFilter:
      oneOf:
        - $ref: "#/components/schemas/TimeSeriesDimensionFilterOperatorEqWithNameConstrai\
            nt"
        - type: object
          properties:
            name:
              type: string
            operator:
              type: string
              const: exists
            value:
              type: boolean
          required:
            - name
            - operator
            - value
    InsightsQueryRequest:
      type: object
      properties:
        bucketSize:
          type: number
        dimensionFilters:
          type: array
          items:
            $ref: "#/components/schemas/TimeSeriesDimensionFilter"
        dimensionSplits:
          type: array
          items:
            type: string
        endTime:
          type: number
        metricExpressions:
          type: array
          items:
            type: string
        startTime:
          type: number
      required:
        - metricExpressions
    CountedJobState:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/JobState"
    JobState:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier.
        state:
          type: string
          description: Current state.
      required:
        - id
        - state
    CountedJobInfoResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/JobInfoResponse"
    JobStatusResponse:
      type: object
      properties:
        reason:
          $ref: "#/components/schemas/TaskErrorDetail"
          description: Reason the job entered its current <code>state</code>, typically
            populated upon failure. May include a nested <code>reason</code> for
            wrapped errors.
        state:
          type: string
      required:
        - state
    JobInfoResponse:
      type: object
      properties:
        args:
          $ref: "#/components/schemas/RunnableJob"
          description: Configuration and run settings used to launch the job.
        id:
          type: string
          description: Unique identifier for the job.
        keep:
          type: boolean
          description: If <code>true</code>, retain the job and its artifacts instead of
            deleting according to the time-to-live or retention policy. The job
            persists until it is manually deleted.
        stats:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeJobInfoStats"
          description: Counters and metrics collected during job execution.
        status:
          $ref: "#/components/schemas/JobStatusResponse"
      required:
        - args
        - id
        - stats
        - status
    JobRunTypes:
      type: string
      enum:
        - adhoc
        - scheduled
        - system
      x-speakeasy-unknown-values: allow
    StateType:
      type: string
      enum:
        - cancelled
        - failed
        - finished
        - initializing
        - orphaned
        - paused
        - pending
        - running
        - unknown
      x-speakeasy-unknown-values: allow
    PaginatedJobInfoResponse:
      type: object
      properties:
        items:
          type: array
          description: the pre-limited items in the list of results
          items:
            $ref: "#/components/schemas/JobInfoResponse"
        count:
          type: integer
          description: number of items present in the items array
        offset:
          type: integer
          description: pagination offset
        limit:
          type: integer
          description: pagination limit
        totalCount:
          type: integer
          description: total number of items available (present when limit is set)
    DiagnosticEvent:
      type: object
      properties:
        __criblEventType:
          type: string
          const: diagnostic
        collectorType:
          type: string
        payload:
          type: object
          additionalProperties: true
        phase:
          type: string
        taskId:
          type: string
        timestamp:
          type: number
      required:
        - __criblEventType
        - collectorType
        - payload
        - phase
        - taskId
        - timestamp
    DiagnosticEventIHttpDiagnosticPayload:
      type: object
      properties:
        __criblEventType:
          type: string
          const: diagnostic
        collectorType:
          type: string
        payload:
          type: object
          additionalProperties: true
        phase:
          type: string
        taskId:
          type: string
        timestamp:
          type: number
      required:
        - __criblEventType
        - collectorType
        - payload
        - phase
        - taskId
        - timestamp
    DiagnosticStreamLine:
      $ref: "#/components/schemas/DiagnosticEventIHttpDiagnosticPayload"
    ResultsMetadata:
      type: object
      properties:
        approximateCount:
          type: number
        collectedBytes:
          type: number
        discoveryComplete:
          type: integer
          enum:
            - 0
            - 1
          x-speakeasy-unknown-values: allow
          x-speakeasy-enums:
            - DiscoveryCompleteZero
            - DiscoveryCompleteOne
        estimatedSize:
          type: number
        partial:
          type: boolean
      required:
        - approximateCount
        - partial
      title: ResultsMetadata
    ResultEvent:
      type: object
      additionalProperties: true
      properties:
        collectorId:
          type: string
        collectorType:
          type: string
        compression:
          type: string
          enum:
            - gzip
            - none
            - zstd
            - lz4
          x-speakeasy-unknown-values: allow
        earliest:
          type: number
        fields:
          type: object
          additionalProperties: true
        format:
          type: string
          enum:
            - raw
            - events
          x-speakeasy-unknown-values: allow
        guid:
          type: string
        host:
          type: string
        id:
          type: string
        latest:
          type: number
        metricDims:
          type: object
          additionalProperties: true
        size:
          type: number
        source:
          type: string
        state:
          type: object
          additionalProperties: true
        stateKey:
          type: string
        taskId:
          type: string
      required:
        - collectorId
        - host
        - taskId
      title: ResultEvent
    ResultsStreamLine:
      oneOf:
        - $ref: "#/components/schemas/ResultsMetadata"
        - $ref: "#/components/schemas/ResultEvent"
    TaskError:
      type: object
      properties:
        error:
          $ref: "#/components/schemas/TaskErrorDetail"
        taskId:
          type: string
        timestamp:
          type: number
      required:
        - error
        - taskId
        - timestamp
    CountedKmsProviderConfig:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/KMSProviderConfig"
    AUTH_PROVIDER:
      type: string
      enum:
        - token
        - aws-iam
        - aws-ec2
      x-speakeasy-unknown-values: allow
    VaultKMSAuthConfig:
      type: object
      properties:
        assumeRoleArn:
          type: string
        assumeRoleExternalId:
          type: string
        awsApiKey:
          type: string
        awsAuthenticationMethod:
          type: string
        awsSecretKey:
          type: string
        enableAssumeRole:
          type: boolean
        provider:
          $ref: "#/components/schemas/AUTH_PROVIDER"
        token:
          type: string
        vaultAWSIAMServerID:
          type: string
        vaultRole:
          type: string
      required:
        - provider
        - vaultAWSIAMServerID
      title: VaultKMSAuthConfig
    AWSKMSAuthConfig:
      type: object
      properties:
        assumeRoleArn:
          type: string
        assumeRoleExternalId:
          type: string
        awsApiKey:
          type: string
        awsAuthenticationMethod:
          type: string
        awsSecretKey:
          type: string
        enableAssumeRole:
          type: boolean
      title: AWSKMSAuthConfig
    VaultKMSEngineConfig:
      type: object
      properties:
        mount:
          type: string
        secretPath:
          type: string
        type:
          type: string
          const: kv2
      required:
        - type
    SECRET_PROVIDER:
      type: string
      enum:
        - local
        - vault
        - aws-kms
      x-speakeasy-unknown-values: allow
    AWSKMSServiceConfig:
      type: object
      properties:
        kmsKeyArn:
          type: string
        region:
          type: string
      required:
        - kmsKeyArn
        - region
    VaultKMSTlsClientConfig:
      type: object
      properties:
        caPath:
          type: string
        certPath:
          type: string
        certificateName:
          type: string
        disabled:
          type: boolean
        maxVersion:
          $ref: "#/components/schemas/SecureVersion"
        minVersion:
          $ref: "#/components/schemas/SecureVersion"
        passphrase:
          type: string
        privKeyPath:
          type: string
        rejectUnauthorized:
          type: boolean
        servername:
          type: string
      required:
        - disabled
    KMSProviderConfig:
      type: object
      properties:
        auth:
          oneOf:
            - $ref: "#/components/schemas/VaultKMSAuthConfig"
            - $ref: "#/components/schemas/AWSKMSAuthConfig"
        enableHealthCheck:
          type: boolean
        engine:
          $ref: "#/components/schemas/VaultKMSEngineConfig"
        healthCheckEndpoint:
          type: string
        namespace:
          type: string
        provider:
          $ref: "#/components/schemas/SECRET_PROVIDER"
        secretDir:
          type: string
        service:
          $ref: "#/components/schemas/AWSKMSServiceConfig"
        tls:
          $ref: "#/components/schemas/VaultKMSTlsClientConfig"
        url:
          type: string
      required:
        - enableHealthCheck
        - provider
    CountedKmsHealth:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/KMSHealth"
    KMSHealthStatus:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 3
      x-speakeasy-unknown-values: allow
      x-speakeasy-enums:
        - Green
        - Red
        - Unknown
        - Yellow
    KMSHealthTest:
      type: object
      properties:
        details:
          type: object
          additionalProperties: true
        error:
          type: object
          required:
            - name
            - message
          properties:
            name:
              type: string
            message:
              type: string
            stack:
              type: string
        status:
          $ref: "#/components/schemas/KMSHealthStatus"
      required:
        - status
    KMSHealth:
      type: object
      properties:
        auth:
          $ref: "#/components/schemas/KMSHealthTest"
        connection:
          $ref: "#/components/schemas/KMSHealthTest"
        system:
          $ref: "#/components/schemas/KMSHealthTest"
      required:
        - auth
        - connection
        - system
    CountedLicense:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/License"
    LicenseType:
      type: string
      enum:
        - prod
        - trial
        - free
      x-speakeasy-unknown-values: allow
    License:
      type: object
      properties:
        cls:
          $ref: "#/components/schemas/LicenseType"
          description: License class.
        email:
          type: string
          description: Contact email for the license.
        exp:
          type: integer
          description: Timestamp (in Unix time) when the license expires, in seconds.
        f_ph:
          type: integer
          description: If true, license phone-home enforcement is enabled. Otherwise, false.
        f_phg:
          type: integer
          description: Phone-home grace period, in 5-minute intervals.
        guid:
          type: string
          description: Unique identifier for the Cribl deployment associated with the
            license state.
        iat:
          type: integer
          description: Timestamp (in Unix time) when the license was issued, in seconds.
        id:
          type: string
          description: Unique identifier for the license.
        iss:
          type: string
          description: License issuer.
        license:
          type: string
          description: License string.
        limits:
          type: object
          properties:
            app_platform:
              type: integer
              description: App Platform limit.
            edge_groups:
              type: integer
              description: Maximum number of Edge Fleets.
            edge_procs:
              type: integer
              description: Maximum number of Edge Processes.
            kms:
              type: integer
              description: Maximum number of Key Management Service (KMS) providers.
            lake_access_groups:
              type: integer
              description: Maximum number of Cribl Lake access groups.
            lake_ddss:
              type: integer
              description: Cribl Lake Dynamic Data Self Storage (DDSS) limit.
            lake_metrics:
              type: integer
              description: Cribl Lake metrics limit.
            lake_storage_locations:
              type: integer
              description: Maximum number of Cribl Lake Storage Locations.
            lakehouse:
              type: integer
              description: Lakehouse limit.
            leader_resiliency:
              type: integer
              description: Leader resiliency limit.
            max_executors_per_search:
              type: integer
              description: Maximum number of executors per search.
            notifications:
              type: integer
              description: Maximum number of Notifications.
            outpost:
              type: integer
              description: Cribl Outpost limit.
            outpost_groups:
              type: integer
              description: Maximum number of Cribl Outpost Groups.
            persistent_queue:
              type: integer
              description: Persistent queue limit.
            projects:
              type: integer
              description: Maximum number of Data Projects (Data Subscriptions).
            rbac:
              type: integer
              description: Maximum number of role-based access control (RBAC) users.
            remote_auth:
              type: integer
              description: Maximum number of remote authentication connections.
            remote_git:
              type: integer
              description: Maximum number of remote Git connections.
            s3_bundle:
              type: integer
              description: S3 bundle limit.
            sds:
              type: integer
              description: Sensitive data scanning (SDS) limit.
            search_acceleration:
              type: integer
              description: "Dataset acceleration limit. NOTE: Dataset acceleration is
                deprecated."
            search_groups:
              type: integer
              description: Maximum number of Cribl Search Groups.
            system_email:
              type: integer
              description: System email limit.
            worker_groups:
              type: integer
              description: Maximum number of Worker Groups.
            worker_procs:
              type: integer
              description: Maximum number of Worker Processes.
          description: License limits.
        quota:
          type: integer
          description: Allowed throughput (GB per day) under the license.
        sub:
          type: string
          description: Identifier for the license owner or customer.
        title:
          type: string
          description: License title.
      required:
        - cls
        - email
        - exp
        - f_ph
        - f_phg
        - guid
        - iat
        - id
        - iss
        - license
        - quota
        - title
    LicenseRequest:
      type: object
      properties:
        license:
          type: string
          description: The Cribl license to add.
      required:
        - license
    CountedUsageMetricsExtended:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/UsageMetricsExtended"
    EdgeUsageMetrics:
      type: object
      properties:
        droppedBytes:
          type: integer
          description: Number of dropped bytes.
        exemptedLicenseInBytes:
          type: integer
          description: Number of license-exempt inbound bytes.
        inBytes:
          type: integer
          description: Number of inbound bytes.
        inEvents:
          type: integer
          description: Number of inbound events.
        inMetricsEvents:
          type: integer
          description: Number of inbound metric events.
        outBytes:
          type: integer
          description: Number of outbound bytes.
        outEvents:
          type: integer
          description: Number of outbound events.
      required:
        - exemptedLicenseInBytes
        - inBytes
        - inEvents
        - outBytes
        - outEvents
    GuardUsageMetrics:
      type: object
      properties:
        inBytes:
          type: integer
          description: Number of inbound bytes.
        inEvents:
          type: integer
          description: Number of inbound events.
      required:
        - inBytes
        - inEvents
    UsageMetricsExtended:
      type: object
      properties:
        droppedBytes:
          type: integer
          description: Number of dropped bytes.
        edge:
          $ref: "#/components/schemas/EdgeUsageMetrics"
          description: Edge usage metrics for this time range.
        endTime:
          type: integer
          description: Timestamp (in Unix time) for the end of the reporting period, in
            milliseconds. Together with <code>startTime</code>, defines the time
            range of the usage metrics.
        exemptedLicenseInBytes:
          type: integer
          description: Number of license-exempt inbound bytes.
        guard:
          $ref: "#/components/schemas/GuardUsageMetrics"
          description: Guard usage metrics for this time range.
        inBytes:
          type: integer
          description: Number of inbound bytes.
        inEvents:
          type: integer
          description: Number of inbound events.
        inMetricsEvents:
          type: integer
          description: Number of inbound metric events.
        outBytes:
          type: integer
          description: Number of outbound bytes.
        outEvents:
          type: integer
          description: Number of outbound events.
        startTime:
          type: integer
          description: Timestamp (in Unix time) for the start of the reporting period, in
            milliseconds. Together with <code>endTime</code>, defines the time
            range of the usage metrics.
      required:
        - endTime
        - exemptedLicenseInBytes
        - inBytes
        - inEvents
        - outBytes
        - outEvents
        - startTime
    LoggerEntry:
      type: object
      properties:
        canDelete:
          type: boolean
        id:
          type: string
        level:
          type: string
        ttl:
          type: number
      required:
        - id
        - level
    TtlConfig:
      type: object
      additionalProperties:
        type: object
        properties:
          level:
            type: string
          ttl:
            type: number
        required:
          - level
          - ttl
    LoggerConfig:
      type: object
      properties:
        channels:
          type: array
          items:
            $ref: "#/components/schemas/LoggerEntry"
        defaultRedactFields:
          type: array
          items:
            type: string
        id:
          type: string
        limitRate:
          type: number
        maxFiles:
          type: number
        maxSizeBytes:
          type: number
        redactFields:
          type: array
          items:
            type: string
        redactLabel:
          type: string
        ttlConfig:
          $ref: "#/components/schemas/TtlConfig"
      required:
        - channels
        - id
        - limitRate
        - redactFields
        - redactLabel
    CountedLoggerConfig:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/LoggerConfig"
    CountedLogSearchResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/LogSearchResult"
    LogSearchResult:
      type: object
      properties:
        endOfResults:
          type: boolean
        events:
          type: array
          items:
            type: object
            additionalProperties: true
        offset:
          type: array
          items:
            type: string
      required:
        - endOfResults
        - events
        - offset
    CountedLogFetcherResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/LogFetcherResult"
    LogFetcherResult:
      type: object
      properties:
        endOfResults:
          type: boolean
        events:
          type: array
          items:
            type: object
            additionalProperties: true
        file:
          type: string
        nextOffset:
          type: string
        previousOffset:
          type: string
      required:
        - endOfResults
        - events
        - file
        - nextOffset
        - previousOffset
    CountedLogFileInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/LogFileInfo"
    LogFileInfo:
      type: object
      properties:
        id:
          type: string
        path:
          type: string
        size:
          type: number
      required:
        - id
        - path
    LogsRequestType:
      type: string
      enum:
        - multi
        - single
        - group
      x-speakeasy-unknown-values: allow
    OverlayEntrySource:
      type: string
      enum:
        - sideload
        - s3
      x-speakeasy-unknown-values: allow
    OverlayListResponseItem:
      type: object
      properties:
        binaryVersion:
          type: string
          description: Binary-version path segment where this artifact is stored on disk.
        builtAt:
          type: string
          description: ISO-8601 build timestamp from overlay-metadata.json.
        commitSha:
          type:
            - "null"
            - string
          description: Short git SHA from overlay-metadata.json. Null when unavailable
            from the S3 manifest.
        overlayId:
          type: string
          description: Overlay identifier.
          examples:
            - patch.0
            - sideload.a1b2c3d
        remoteUrl:
          type:
            - "null"
            - string
          description: S3/public download URL for published overlays, null for sideloads.
        source:
          $ref: "#/components/schemas/OverlayEntrySource"
          description: Disk source backing this artifact.
        targetBinaryVersion:
          type: string
          description: Binary version this overlay targets from overlay-metadata.json.
      required:
        - binaryVersion
        - builtAt
        - commitSha
        - overlayId
        - remoteUrl
        - source
        - targetBinaryVersion
    OverlayListResponse:
      type: object
      properties:
        count:
          type: integer
          description: Number of overlay artifacts returned in this response.
        items:
          type: array
          items:
            $ref: "#/components/schemas/OverlayListResponseItem"
          description: Overlay artifacts returned for this page.
        limit:
          type: integer
          description: Maximum number of overlay artifacts requested for this page.
        offset:
          type: integer
          description: Starting point used for this page when pagination is requested.
        totalCount:
          type: integer
          description: Total number of matching overlay artifacts before pagination.
      required:
        - count
        - items
    OverlayGetResponse:
      type: object
      properties:
        count:
          type: integer
          description: Number of overlay artifacts returned in this response.
        items:
          type: array
          items:
            $ref: "#/components/schemas/OverlayListResponseItem"
          description: Matching overlay artifact.
      required:
        - count
        - items
    OverlayWorkerStatus:
      type: string
      enum:
        - active
        - none
      x-speakeasy-unknown-values: allow
    OverlayWorkerStatusItem:
      type: object
      properties:
        binaryVersion:
          type:
            - "null"
            - string
          description: Binary version reported by the worker, or <code>null</code> when
            unavailable.
        guid:
          type: string
          description: Worker GUID.
        hostname:
          type:
            - "null"
            - string
          description: Worker hostname, or <code>null</code> when unavailable.
        overlayId:
          type:
            - "null"
            - string
          description: Active overlay identifier reported by the worker, or
            <code>null</code> when no overlay is active.
          examples:
            - patch.0
            - sideload.a1b2c3d
        overlayStatus:
          $ref: "#/components/schemas/OverlayWorkerStatus"
          description: Overlay status reported by the worker.
      required:
        - binaryVersion
        - guid
        - hostname
        - overlayId
        - overlayStatus
    OverlayGroupStatusItem:
      type: object
      properties:
        count:
          type: integer
          description: Number of workers in this group.
        groupId:
          type: string
          description: Worker group identifier.
        workers:
          type: array
          items:
            $ref: "#/components/schemas/OverlayWorkerStatusItem"
          description: Overlay status for each connected worker in this group.
      required:
        - count
        - groupId
        - workers
    OverlayStatusResponse:
      type: object
      properties:
        count:
          type: integer
          description: Number of worker groups returned in this response.
        items:
          type: array
          items:
            $ref: "#/components/schemas/OverlayGroupStatusItem"
          description: Worker group overlay status items returned for this page.
        limit:
          type: integer
          description: Maximum number of worker groups requested for this page.
        offset:
          type: integer
          description: Starting point used for this page when pagination is requested.
        totalCount:
          type: integer
          description: Total number of worker groups before pagination.
      required:
        - count
        - items
    OverlayRefreshResponseItem:
      type: object
      properties:
        message:
          type: string
          description: Human-readable refresh request status.
      required:
        - message
    OverlayRefreshResponse:
      type: object
      properties:
        count:
          type: integer
          description: Number of refresh status items returned in this response.
        items:
          type: array
          items:
            $ref: "#/components/schemas/OverlayRefreshResponseItem"
          description: Refresh status items.
      required:
        - count
        - items
    CountedOverlaySideloadDeleteResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/OverlaySideloadDeleteResponse"
    OverlaySideloadDeleteResponseItem:
      type: object
      properties:
        binaryVersion:
          type: string
          description: Binary version for the removed sideloaded overlay.
        overlayId:
          type: string
          description: Overlay identifier for the removed sideloaded overlay.
          examples:
            - patch.0
            - sideload.a1b2c3d
      required:
        - binaryVersion
        - overlayId
    OverlaySideloadDeleteResponse:
      type: array
      items:
        $ref: "#/components/schemas/OverlaySideloadDeleteResponseItem"
    CountedOverlaySideloadApplyResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/OverlaySideloadApplyResponse"
    OverlaySideloadApplyResponseItem:
      type: object
      properties:
        appliedAt:
          type: string
          description: ISO-8601 timestamp of when the bundle was accepted and staged.
        binaryVersion:
          type: string
          description: Binary version the uploaded overlay targets.
        overlayId:
          type: string
          description: Overlay identifier.
          examples:
            - patch.0
            - sideload.a1b2c3d
      required:
        - appliedAt
        - binaryVersion
        - overlayId
    OverlaySideloadApplyResponse:
      type: array
      items:
        $ref: "#/components/schemas/OverlaySideloadApplyResponseItem"
    CountedPackInstallInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/PackInstallInfo"
    InstallWarnings:
      type: array
      items:
        type: string
    PackInstallInfo:
      type: object
      properties:
        author:
          type: string
        collectors:
          type: number
        dependencies:
          type: object
          additionalProperties:
            type: string
        description:
          type: string
        displayName:
          type: string
        exports:
          type: array
          items:
            type: string
        id:
          type: string
          description: Unique identifier.
        inputs:
          type: number
        isDisabled:
          type: boolean
        minLogStreamVersion:
          type: string
        outputs:
          type: number
        settings:
          type: object
          additionalProperties: true
        source:
          type: string
        spec:
          type: string
        tags:
          $ref: "#/components/schemas/TagsTypePackInstallInfo"
        version:
          type: string
        warnings:
          $ref: "#/components/schemas/InstallWarnings"
      required:
        - id
        - source
    PackRequestBody:
      type: object
      properties:
        id:
          type: string
        spec:
          type: string
        version:
          type: string
        minLogStreamVersion:
          type: string
        displayName:
          type: string
        author:
          type: string
        description:
          type: string
        source:
          type: string
          description: The source of the pack. If not present, an empty pack will be created
        tags:
          $ref: "#/components/schemas/TagsTypePackInstallInfo"
        allowCustomFunctions:
          type: boolean
        force:
          type: boolean
      anyOf:
        - required:
            - id
        - required:
            - source
    CountedPackUninstallInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/PackUninstallInfo"
    PackUninstallInfo:
      type: object
      properties:
        id:
          type: string
        source:
          type: string
      required:
        - id
        - source
    CountedPackInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/PackInfo"
    PackInfo:
      type: object
      properties:
        author:
          type: string
        collectors:
          type: number
        dependencies:
          type: object
          additionalProperties:
            type: string
        description:
          type: string
        displayName:
          type: string
        exports:
          type: array
          items:
            type: string
        id:
          type: string
          description: Unique identifier.
        inputs:
          type: number
        isDisabled:
          type: boolean
        minLogStreamVersion:
          type: string
        outputs:
          type: number
        settings:
          type: object
          additionalProperties: true
        source:
          type: string
        spec:
          type: string
        tags:
          $ref: "#/components/schemas/TagsTypePackInstallInfo"
        version:
          type: string
      required:
        - id
        - source
    PackUpgradeRequest:
      type: object
      properties:
        allowCustomFunctions:
          type: boolean
        minor:
          type: string
        source:
          type: string
        spec:
          type: string
      required:
        - source
    GroupPackInstallInfo:
      type: object
      properties:
        author:
          type: string
        collectors:
          type: number
        dependencies:
          type: object
          additionalProperties:
            type: string
        description:
          type: string
        displayName:
          type: string
        exports:
          type: array
          items:
            type: string
        group:
          type: string
          description: The Worker Group or Edge Fleet where the Pack was installed.
        id:
          type: string
          description: Unique identifier.
        inputs:
          type: number
        isDisabled:
          type: boolean
        minLogStreamVersion:
          type: string
        outputs:
          type: number
        settings:
          type: object
          additionalProperties: true
        source:
          type: string
        spec:
          type: string
        tags:
          $ref: "#/components/schemas/TagsTypePackInstallInfo"
        version:
          type: string
        warnings:
          $ref: "#/components/schemas/InstallWarnings"
      required:
        - group
        - id
        - source
    InstalledPacksResponse:
      type: object
      properties:
        installed:
          type: array
          items:
            $ref: "#/components/schemas/GroupPackInstallInfo"
          description: List of Packs that were successfully installed.
      required:
        - installed
    PackClone:
      type: object
      properties:
        dest:
          type: string
        dstGroups:
          type: array
          items:
            type: string
        force:
          type: boolean
        packs:
          type: array
          items:
            type: string
        srcGroup:
          type: string
      required:
        - dstGroups
        - packs
        - srcGroup
    CountedReferencingEntity:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ReferencingEntity"
    ReferencingEntity:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the referenced entity.
        refs:
          type: array
          items:
            $ref: "#/components/schemas/ReferencedEntity"
          description: Array of entity references for objects outside the Pack.
        type:
          type: string
          description: Entity type.
          example: inputs
      required:
        - id
        - refs
        - type
      description: Entity that holds references to objects outside its Pack.
    PackExportModeTypes:
      type: string
      enum:
        - merge_safe
        - merge
        - default_only
      x-speakeasy-unknown-values: allow
    UploadPackResponse:
      type: object
      properties:
        source:
          type: string
      required:
        - source
    CountedPublishPackResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/PublishPackResponse"
    PublishPackToGitStatusType:
      type: string
      enum:
        - error
        - success
        - noop
      x-speakeasy-unknown-values: allow
    PublishPackResponse:
      type: object
      properties:
        git:
          type: object
          properties:
            branch:
              type: string
            commitHash:
              type: string
            commitMessage:
              type: string
          required:
            - branch
            - commitHash
            - commitMessage
        id:
          type: string
        message:
          type: string
        source:
          type: string
        status:
          $ref: "#/components/schemas/PublishPackToGitStatusType"
      required:
        - id
    CaptureFunctions:
      type: object
      properties:
        bytesIn:
          type: integer
          description: Bytes ingested by the Function.
        bytesOut:
          type: integer
          description: Bytes emitted by the Function.
        disabled:
          type: boolean
          description: If <code>true</code>, the Function was disabled during the preview
            operation.
        duration:
          type: number
          description: Processing duration, in milliseconds.
        eventsIn:
          type: integer
          description: Number of events ingested by the Function.
        eventsOut:
          type: integer
          description: Number of events emitted by the Function.
        func:
          type: string
          description: Name of the Function.
      required:
        - bytesIn
        - bytesOut
        - duration
        - eventsIn
        - eventsOut
        - func
      description: Per-Function statistics for a Pipeline preview operation.
    CaptureStats:
      type: object
      properties:
        cpu:
          type: object
          properties:
            system:
              type: number
              description: System CPU time consumed during preview, in microseconds.
            user:
              type: number
              description: User CPU time consumed during preview, in microseconds.
          required:
            - system
            - user
          description: Information about CPU usage during preview, in microseconds.
        duration:
          type: number
          description: Total preview duration, in milliseconds.
        functions:
          type: array
          items:
            $ref: "#/components/schemas/CaptureFunctions"
          description: Per-Function statistics for a Pipeline preview operation.
      required:
        - cpu
        - duration
        - functions
      description: Aggregate statistics from a Pipeline preview operation.
    PreviewResponse:
      type: object
      properties:
        count:
          type: integer
          description: Total count of captured events.
        items:
          type: array
          items:
            $ref: "#/components/schemas/CapturedEvent"
          description: Array of events captured during Pipeline preview.
        message:
          type: string
          description: Informational message (for example, truncation or timeout warning).
        profile:
          type: string
          description: CPU profile ID for download when <code>cpuProfile</code> is
            requested.
        stats:
          $ref: "#/components/schemas/CaptureStats"
          description: Aggregate and per-Function statistics for a Pipeline preview
            operation.
        stderr:
          type: string
          description: Standard error output from the preview operation.
      required:
        - count
        - items
        - stderr
      description: Additional metadata returned with Pipeline preview results.
    PreviewDataParams:
      type: object
      properties:
        cpuProfile:
          type: boolean
          description: If <code>true</code>, enable CPU profiling and return a profile ID
            for download.
        dropped:
          type: boolean
          description: If <code>true</code>, include dropped events (events that did not
            match Routes) in the output of the preview operation.
        enhanceMetricsOutput:
          type: boolean
          description: If <code>true</code>, enhance metrics output by evaluating
            <code>nameExpr</code>, metric name expressions associated with
            metrics output, in the response.
        events:
          type: array
          items:
            type: object
            additionalProperties: true
          description: Inline event data. When provided, <code>sampleId</code> is ignored
            and events are sent directly through the Pipeline.
        inputId:
          type: string
          description: The <code>id</code> of the Source to emulate when <code>mode</code>
            is <code>route</code> or <code>routeAndSend</code>.
        level:
          $ref: "#/components/schemas/CaptureLevel"
          description: Capture stage when using <code>route</code> or
            <code>routeAndSend</code>. <br/><br/> <code>0</code> == Before
            pre-processing<br/> <code>1</code> == Before Routes<br/>
            <code>2</code> == Before post-processing<br/> <code>3</code> ==
            Before Destination.
        memory:
          type: integer
          description: Memory limit for the forked preview operation, in MB. Default is
            2048.
        mode:
          type: string
          enum:
            - pipe
            - route
            - routeAndSend
          description: Preview mode. <code>pipe</code> sends events through a Pipeline
            directly. <code>route</code> emulates events from a Source.
            <code>routeAndSend</code> routes and sends to Destinations.
          x-speakeasy-unknown-values: allow
        pipelineId:
          type: string
          description: ID of the Pipeline to run.
        sampleId:
          type: string
          description: ID of the saved sample to load events from. Use empty string when
            providing <code>events</code> inline.
        samplePipelineId:
          type: string
          description: Optional <code>id</code> of the Pipeline to use when loading from a
            sample. Overrides the Pipeline that the sample was saved with.
        timeout:
          type: integer
          description: Timeout for the preview operation, in milliseconds. Default is 10000.
      required:
        - mode
        - pipelineId
        - sampleId
      description: Parameters for the Pipeline preview request. Send sample events
        through a Pipeline and receive transformed output.
    CountedProcessEntry:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/ProcessEntry"
    ProcessEntry:
      type: object
      properties:
        env:
          type: object
          additionalProperties: true
        id:
          type: string
        pid:
          type: number
        restartOnExit:
          type: boolean
        restarts:
          type: number
        startTime:
          type: number
        type:
          type: string
      required:
        - id
        - restartOnExit
        - restarts
        - startTime
        - type
    CountedGitCommitSummary:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitCommitSummary"
    GitFileRename:
      type: object
      properties:
        from:
          type: string
          description: Original file path before the rename.
        to:
          type: string
          description: New file path after the rename.
      required:
        - from
        - to
    GitCommitSummary:
      type: object
      properties:
        author:
          type: object
          properties:
            email:
              type: string
            name:
              type: string
          required:
            - email
            - name
        branch:
          type: string
        commit:
          type: string
        files:
          $ref: "#/components/schemas/FilesTypeGitCommitSummary"
        summary:
          type: object
          properties:
            changes:
              type: number
            deletions:
              type: number
            insertions:
              type: number
          required:
            - changes
            - deletions
            - insertions
      required:
        - branch
        - commit
        - summary
    ProjectGitCommitParams:
      type: object
      properties:
        effective:
          type: boolean
        message:
          type: string
      required:
        - message
    CountedGitCountResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitCountResult"
    GitCountResult:
      type: object
      properties:
        count:
          type: number
      required:
        - count
    CountedGitDiffResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitDiffResult"
    DiffFiles:
      type: array
      items:
        type: object
        properties:
          addedLines:
            type: number
          blocks:
            type: array
            items:
              type: object
              properties:
                header:
                  type: string
                lines:
                  $ref: "#/components/schemas/DiffLine"
                newStartLine:
                  type: number
                oldStartLine:
                  type: number
                oldStartLine2:
                  type: number
              required:
                - header
                - lines
                - newStartLine
                - oldStartLine
          changedPercentage:
            type: number
          checksumAfter:
            type: string
          checksumBefore:
            $ref: "#/components/schemas/ScalarOrArray"
          deletedFileMode:
            type: string
          deletedLines:
            type: number
          isBinary:
            type: boolean
          isCombined:
            type: boolean
          isCopy:
            type: boolean
          isDeleted:
            type: boolean
          isGitDiff:
            type: boolean
          isNew:
            type: boolean
          isRename:
            type: boolean
          isTooBig:
            type: boolean
          language:
            type: string
          mode:
            type: string
          newFileMode:
            type: string
          newMode:
            type: string
          newName:
            type: string
          oldMode:
            $ref: "#/components/schemas/ScalarOrArray"
          oldName:
            type: string
          unchangedPercentage:
            type: number
        required:
          - addedLines
          - blocks
          - deletedLines
          - isCombined
          - isGitDiff
          - language
          - newName
          - oldName
    GitDiffResult:
      type: object
      properties:
        diffJson:
          $ref: "#/components/schemas/DiffFiles"
      required:
        - diffJson
    CountedGitFilesResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitFilesResponse"
    GitFile:
      type: object
      properties:
        children:
          type: array
          items:
            $ref: "#/components/schemas/GitFile"
        name:
          type: string
        state:
          type: string
      required:
        - name
    GitFilesResponse:
      type: object
      properties:
        commitMessage:
          type: object
          additionalProperties: true
        count:
          type: number
        items:
          type: array
          items:
            $ref: "#/components/schemas/GitFile"
      required:
        - count
        - items
    CountedGitRevertResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitRevertResult"
    GitRevertResult:
      type: object
      properties:
        audit:
          type: object
          properties:
            files:
              $ref: "#/components/schemas/FilesTypeGitCommitSummary"
            group:
              type: string
            id:
              type: string
          required:
            - id
        reverted:
          type: boolean
      required:
        - audit
        - reverted
    GitRevertParams:
      type: object
      properties:
        commit:
          type: string
        force:
          type: boolean
        message:
          type: string
      required:
        - commit
    CountedGitShowResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitShowResult"
    GitShowResult:
      type: object
      properties:
        commitMessage:
          type: string
        diffJson:
          $ref: "#/components/schemas/DiffFiles"
      required:
        - commitMessage
        - diffJson
    CountedSystemInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SystemInfo"
    PaidAmiType:
      type: integer
      enum:
        - 0
        - 1
        - 2
      x-speakeasy-unknown-values: allow
      x-speakeasy-enums:
        - Ent
        - None
        - Std
    LicenseInfo:
      type: object
      properties:
        customer:
          type: string
        effectiveClass:
          $ref: "#/components/schemas/LicenseType"
        email:
          type: string
        expiration:
          type: number
        guid:
          type: string
        isRunningInSaaS:
          type: boolean
        licenseEnforceReason:
          type: string
        licenseIds:
          type: array
          items:
            type: string
        limits:
          type: object
          properties:
            app_platform:
              type: integer
              description: App Platform limit.
            edge_groups:
              type: integer
              description: Maximum number of Edge Fleets.
            edge_procs:
              type: integer
              description: Maximum number of Edge Processes.
            kms:
              type: integer
              description: Maximum number of Key Management Service (KMS) providers.
            lake_access_groups:
              type: integer
              description: Maximum number of Cribl Lake access groups.
            lake_ddss:
              type: integer
              description: Cribl Lake Dynamic Data Self Storage (DDSS) limit.
            lake_metrics:
              type: integer
              description: Cribl Lake metrics limit.
            lake_storage_locations:
              type: integer
              description: Maximum number of Cribl Lake Storage Locations.
            lakehouse:
              type: integer
              description: Lakehouse limit.
            leader_resiliency:
              type: integer
              description: Leader resiliency limit.
            max_executors_per_search:
              type: integer
              description: Maximum number of executors per search.
            notifications:
              type: integer
              description: Maximum number of Notifications.
            outpost:
              type: integer
              description: Cribl Outpost limit.
            outpost_groups:
              type: integer
              description: Maximum number of Cribl Outpost Groups.
            persistent_queue:
              type: integer
              description: Persistent queue limit.
            projects:
              type: integer
              description: Maximum number of Data Projects (Data Subscriptions).
            rbac:
              type: integer
              description: Maximum number of role-based access control (RBAC) users.
            remote_auth:
              type: integer
              description: Maximum number of remote authentication connections.
            remote_git:
              type: integer
              description: Maximum number of remote Git connections.
            s3_bundle:
              type: integer
              description: S3 bundle limit.
            sds:
              type: integer
              description: Sensitive data scanning (SDS) limit.
            search_acceleration:
              type: integer
              description: "Dataset acceleration limit. NOTE: Dataset acceleration is
                deprecated."
            search_groups:
              type: integer
              description: Maximum number of Cribl Search Groups.
            system_email:
              type: integer
              description: System email limit.
            worker_groups:
              type: integer
              description: Maximum number of Worker Groups.
            worker_procs:
              type: integer
              description: Maximum number of Worker Processes.
        paidAmiType:
          $ref: "#/components/schemas/PaidAmiType"
        phoneHome:
          type: boolean
        phoneHomeGrace:
          type: number
        quota:
          type: number
      required:
        - effectiveClass
        - email
        - expiration
        - guid
        - isRunningInSaaS
        - licenseEnforceReason
        - limits
        - phoneHome
        - phoneHomeGrace
        - quota
    OpenSslInfo:
      type: object
      properties:
        fipsProviderVersion:
          type: string
          description: FIPS provider version string.
        version:
          type: string
          description: OpenSSL version string.
      required:
        - fipsProviderVersion
        - version
    SystemConf:
      type: object
      properties:
        installType:
          type: string
          description: Installation type for the Cribl instance (for example,
            <code>standalone</code> or <code>splunk-app</code>).
        restart:
          type: string
          description: Restart policy for the Cribl instance (for example,
            <code>api</code> to allow restart from the UI, or <code>false</code>
            to disable it).
        upgrade:
          type: string
          description: Upgrade policy for the Cribl instance (for example,
            <code>api</code>, <code>auto</code>, or <code>false</code>).
      required:
        - installType
        - restart
        - upgrade
    SystemInfo:
      type: object
      properties:
        BUILD:
          type: object
          additionalProperties: true
          description: Build metadata for the running Cribl instance.
        apiPort:
          type: number
          description: Port that the Cribl API is listening on.
        appPlatformEnabled:
          type: boolean
          description: "Consolidated App Platform enablement status. <code>true</code>
            only when all of the following are true: the workspace-level App
            Platform kill switch (<code>apps.enabled</code>) is on, the
            <code>feature-app-platform</code> feature flag is enabled, the node
            is running in leader (master) mode, and the license permits App
            Platform. When <code>false</code>, App Platform routes are not
            registered and the UI hides the Apps navigation. Acts as the single
            source of truth for the product UI and Cloud Portal."
        conf:
          type: object
          properties:
            confVersion:
              type: string
              description: Version of the current configuration.
            inputs:
              type: number
              description: Total number of Sources.
            name:
              type: string
              description: Name of the current configuration profile.
            outputs:
              type: number
              description: Total number of Destinations.
            pipelines:
              type: number
              description: Total number of Pipelines.
            routes:
              type: number
              description: Total number of Routes.
            rules:
              type: number
              description: Total number of Rules.
          required:
            - inputs
            - outputs
            - pipelines
            - routes
            - rules
          description: Summary of the Cribl configuration, with counts of Sources,
            Destinations, Pipelines, Routes, and Rules.
        configPath:
          type: string
          description: Filesystem path to the Cribl configuration directory.
        cpus:
          type: array
          items:
            type: object
            properties:
              model:
                type: string
                description: CPU model identifier.
              speed:
                type: number
                description: CPU speed (in MHz).
              times:
                type: object
                additionalProperties: true
                description: CPU time breakdown (user, nice, sys, idle, irq).
            required:
              - model
              - speed
              - times
          description: Array of CPU information for each processor, including model,
            speed, and usage times.
        diskUsage:
          type: object
          properties:
            bytesAvailable:
              type: number
              description: Total available bytes.
            bytesUsed:
              type: number
              description: Total bytes used.
            diskPath:
              type: string
              description: Mount point or device path checked.
            totalDiskSize:
              type: number
              description: Total disk size (in bytes).
          required:
            - bytesAvailable
            - bytesUsed
            - diskPath
            - totalDiskSize
          description: Disk usage information for the Cribl instance.
        distMode:
          type: string
          enum:
            - edge
            - managed-edge
            - master
            - outpost
            - search-supervisor
            - single
            - worker
          description: Distribution mode of the Cribl instance.
          x-speakeasy-unknown-values: allow
        env:
          type: object
          additionalProperties:
            type: string
          description: <code>CRIBL_*</code> and other explicitly allowlisted environment
            variables from the Cribl process, with sensitive values redacted.
        guid:
          type: string
          description: Globally unique identifier for the Cribl instance.
        hasCloudWorkspace:
          type: boolean
          description: If <code>true</code>, the Cribl instance has a Cribl.Cloud Workspace.
        hostname:
          type: string
          description: Hostname of the machine running the Cribl instance.
        insightsEnabled:
          type: boolean
          description: If <code>true</code>, Cribl Insights is enabled.
        installPath:
          type: string
          description: Filesystem path where Cribl is installed.
        isCriblSandbox:
          type: boolean
          description: If <code>true</code>, the Cribl instance is running in a Cribl
            Sandbox environment.
        isFedRampEnabled:
          type: boolean
          description: If <code>true</code>, FedRAMP mode is enabled.
        isFipsEnabled:
          type: boolean
          description: If <code>true</code>, FIPS compliance mode is enabled.
        license:
          $ref: "#/components/schemas/LicenseInfo"
          description: License information for the Cribl instance.
        limits:
          type: object
          properties:
            samples:
              type: object
              properties:
                maxSize:
                  type: string
                  description: Maximum file size for a sample.
              required:
                - maxSize
              description: Information about constraints for sample files.
          required:
            - samples
          description: System resource limits.
        loadavg:
          type: array
          items:
            type: number
          description: System load averages for the past 1, 5, and 15 minutes, in the
            order <code>[1min, 5min, 15min]</code>.
        memory:
          type: object
          properties:
            free:
              type: number
              description: Number of bytes of RAM currently available for use.
            total:
              type: number
              description: Total number of bytes of RAM installed on the system.
          required:
            - free
            - total
          description: System memory information.
        messages:
          type: array
          items:
            $ref: "#/components/schemas/BulletinMessage"
          description: System bulletin messages, such as warnings, errors, and
            informational notices.
        net:
          type: object
          additionalProperties: true
          description: Network interface information. Structure is implementation-dependent.
        openssl:
          $ref: "#/components/schemas/OpenSslInfo"
          description: OpenSSL version and FIPS provider information.
        os:
          type: object
          properties:
            arch:
              type: string
              description: CPU architecture.
            endianness:
              type: string
              description: Byte order that the CPU uses.<br/><br/> <code>LE</code> ==
                little-endian<br/> <code>BE</code> == big-endian.
            platform:
              type: string
              description: Operating system platform.
            release:
              type: string
              description: Operating system release version.
            type:
              type: string
              description: Human-readable name for the operating system.
          required:
            - arch
            - endianness
            - platform
            - release
            - type
          description: Operating system information.
        systemConf:
          $ref: "#/components/schemas/SystemConf"
          description: System configuration settings.
        uptime:
          type: number
          description: System uptime (in seconds).
        version:
          type: string
          description: Version of Cribl software currently running on the host. In some
            responses this may be omitted; use <code>BUILD.VERSION</code> for
            the build version.
        workerProcesses:
          type: number
          description: Number of active Cribl Worker Processes.
      required:
        - BUILD
        - apiPort
        - conf
        - configPath
        - cpus
        - diskUsage
        - distMode
        - env
        - guid
        - hostname
        - installPath
        - license
        - limits
        - loadavg
        - memory
        - messages
        - net
        - os
        - systemConf
        - uptime
        - version
        - workerProcesses
    CountedDiag:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/Diag"
    Diag:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the diagnostic bundle.
        modTime:
          type: number
          description: Timestamp (in Unix time) when the diagnostic bundle was last
            modified.
        path:
          type: string
          description: Filesystem path to the diagnostic bundle.
        size:
          type: integer
          description: Size of the diagnostic bundle, in bytes.
      required:
        - id
        - path
    SendDiagBundle:
      type: object
      properties:
        sendToCribl:
          title: Send to Cribl Support
          description: Send diagnostic bundle to Cribl Support
          type: boolean
        path:
          type: string
          title: Diag bundle file path
          description: Existing bundle that will be sent to Cribl Support. Max 100MB.
        renameJs:
          title: Rename .js files
          description: Append .txt to JavaScript files
          type: boolean
        includeMetrics:
          title: Include metrics
          description: Disable to exclude metrics from the bundle
          type: boolean
        includeGit:
          title: Include git
          description: Disable to exclude the git audit from the bundle. Unavailable for
            worker, managed-edge, and outpost modes
          type: boolean
        includeTopTalkers:
          title: Include top talkers
          description: Include data about your 10 highest-volume Sources, Destinations,
            Pipelines, Routes, and Packs in the diagnostic bundle
          type: boolean
        maxIncludeJobs:
          title: Latest number of jobs
          description: Number of jobs, including all tasks that will be included in the
            bundle
          type: number
          minimum: 0
        includeInstallLogs:
          title: Include installation logs
          description: Enable to include installation logs in the bundle (Windows only)
          type: boolean
        maxLogFiles:
          title: Max log files per type
          description: Maximum number of rotated log files to include per log type (e.g.,
            cribl.log, cribl1.log, etc.). If not specified, all log files
            currently on disk will be included by default to aid in
            troubleshooting. That number can be higher than the current "Number
            of log files to keep" setting if the limit was recently reduced.
            Specify a value to control the size of diagnostic bundles.
          type: number
          minimum: 1
          maximum: 100
    CountedMetricNameInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/MetricNameInfo"
    MetricNameInfo:
      type: object
      properties:
        dims:
          type: array
          items:
            type: object
            properties:
              count:
                type: integer
                description: Number of unique values observed for the dimension.
              name:
                type: string
                description: Name of the dimension.
              values:
                type: array
                items:
                  type: string
                description: Unique values observed for the dimension.
            required:
              - count
              - name
              - values
          description: Dimensions observed for the metric.
        name:
          type: string
          description: Name of the metric.
      required:
        - dims
        - name
    SystemMetricsEnum:
      type: object
      properties:
        dimKeyFilter:
          oneOf:
            - type: string
            - type: array
              items:
                type: string
          description: Dimension names to filter by. Accepts a regular expression or an
            array of dimension names.
        dimValueFilter:
          oneOf:
            - type: string
            - type: array
              items:
                type: string
          description: Dimension values to filter by. Accepts a regular expression or an
            array of dimension values.
        earliest:
          type: number
          description: Start of the query time range. Accepts a timestamp in Unix time
            (milliseconds).
        filterExpr:
          type: string
          description: Filter expression applied to returned metrics.
        maxValues:
          type: integer
          description: Maximum number of values to return per dimension.
        metricNameFilter:
          oneOf:
            - type: string
            - type: array
              items:
                type: string
          description: Metric names to filter by. Accepts a regular expression or an array
            of metric names.
        namespace:
          type: string
          description: Metrics store namespace to query.
    MetricTimeBucket:
      type: object
      additionalProperties:
        type: array
        items:
          type: object
          properties:
            model:
              type: object
              additionalProperties: true
              description: Event model associated with the metric value.
            val:
              type: number
              description: Numeric metric value for the event model in the time bucket.
          required:
            - model
            - val
    QueryResults:
      type: object
      properties:
        exactMatch:
          type: boolean
          description: If <code>true</code>, all requested metric names were found without
            wildcard expansion.
        metrics:
          type: array
          items:
            $ref: "#/components/schemas/MetricTimeBucket"
          description: Array of time buckets, each containing metric values for a time
            interval.
      required:
        - exactMatch
        - metrics
    QueryResultsEnvelop:
      type: object
      additionalProperties: true
      properties:
        results:
          $ref: "#/components/schemas/QueryResults"
          description: Raw metrics query results grouped by time buckets.
      required:
        - results
    CriblEvent:
      type: object
      additionalProperties: true
      properties:
        _raw:
          type: string
          description: Original raw event payload.
      required:
        - _raw
      description: Event payload object that includes the original raw event and
        extracted fields.
    CriblEventEnvelop:
      type: object
      additionalProperties: true
      properties:
        results:
          type: array
          items:
            $ref: "#/components/schemas/CriblEvent"
          description: Aggregated result events.
      required:
        - results
    SystemMetricsQuerySource:
      type: string
      enum:
        - linux
        - windows
      x-speakeasy-unknown-values: allow
    SystemMetricsQueryRequest:
      type: object
      properties:
        aggs:
          allOf:
            - type: object
              properties:
                aggregations:
                  type: array
                  items:
                    type: string
                  description: Aggregation expressions over metric series.
                splitBys:
                  type: array
                  items:
                    type: string
                  description: Dimensions to use for grouping aggregation results.
              required:
                - aggregations
            - oneOf:
                - type: object
                  properties:
                    cumulative:
                      type: boolean
                      description: If <code>true</code>, aggregate into a single cumulative series.
                    timeWindowSeconds:
                      type: integer
                      description: Aggregation interval length, in seconds. Groups metrics into
                        consecutive, non-overlapping time windows of the
                        specified length.
                  required:
                    - timeWindowSeconds
                - type: object
                  properties:
                    cumulative:
                      type: boolean
                      description: If <code>true</code>, aggregate into a single cumulative series.
                    timeWindowSeconds:
                      type: integer
                      description: Aggregation interval length, in seconds. Groups metrics into
                        consecutive, non-overlapping time windows of the
                        specified length.
                  required:
                    - cumulative
          description: Aggregation configuration including expressions, time window,
            dimensions, and cumulative mode.
        alwaysBounds:
          type: boolean
          description: If <code>true</code>, the response includes <code>earliest</code>
            and <code>latest</code> bounds in the results even when no data
            matched the query.
        earliest:
          type:
            - string
            - integer
          description: Start of the query time range. Accepts a relative time string (for
            example, <code>-1h</code>) or a timestamp in Unix time
            (milliseconds).
        latest:
          type:
            - string
            - integer
          description: End of the query time range. Accepts a relative time string (for
            example, <code>now</code>) or a timestamp in Unix time
            (milliseconds).
        namespace:
          type: string
          description: The metrics store namespace. If omitted, uses the default metrics
            store.
        source:
          $ref: "#/components/schemas/SystemMetricsQuerySource"
          description: The data source providing the system metrics.
        where:
          type: string
          description: Filter expression applied to retrieved metrics.
      required:
        - aggs
    CountedAuthConfig:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/AuthConfig"
    AuthConfig:
      type: object
      additionalProperties: true
      properties:
        email_whitelist:
          type: array
          items:
            type: string
          description: 'Wildcard list of email patterns allowed to authenticate. Use with
            <code>filter_type: email_whitelist</code> (for example,
            <code>["*@example.com"]</code>).'
        fallback:
          type: boolean
          description: If <code>true</code>, falls back to local authentication if remote
            authentication fails.
        fallbackBadLogin:
          type: boolean
          description: If <code>true</code>, falls back to local authentication on bad
            login attempts.
        filter:
          type: string
          description: 'JavaScript expression evaluated against user profile attributes.
            Use with <code>filter_type: expression</code>. Users can
            authenticate if the expression evaluates to <code>true</code> (for
            example, <code>email.endsWith("domain.com")</code>).'
        filter_type:
          type: string
          enum:
            - email_whitelist
            - expression
          description: 'Filter for access control. Determines which users can
            authenticate.<br/><br/> <code>email_whitelist</code> (default): Only
            users whose email matches entries in the allowlist can
            authenticate.<br/> <code>expression</code>: Use a JavaScript
            expression to evaluate user profile attributes, such as
            <code>email.endsWith("domain.com")</code>. Users can authenticate if
            the expression evaluates to true.'
          x-speakeasy-unknown-values: allow
        host:
          type: string
          description: Hostname of the authentication server.
        port:
          type: integer
          description: Port of the authentication server.
        ssl:
          type: boolean
          description: If <code>true</code>, SSL is enabled for authentication server
            communication.
        type:
          type: string
          enum:
            - ldap
            - local
            - openid
            - saas
            - saml
            - splunk
          description: Authentication type.
          x-speakeasy-unknown-values: allow
      required:
        - fallback
        - fallbackBadLogin
        - host
        - port
        - ssl
        - type
    CountedSystemSettingsConf:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SystemSettingsConf"
    EmptyObject:
      type: object
      additionalProperties: false
      title: EmptyObject
    BackupsSettings:
      oneOf:
        - type: object
          properties:
            backupPersistence:
              type: string
            backupsDirectory:
              type: string
          required:
            - backupPersistence
            - backupsDirectory
        - $ref: "#/components/schemas/EmptyObject"
    PiiSettings:
      oneOf:
        - type: object
          properties:
            enablePiiDetection:
              type: boolean
          required:
            - enablePiiDetection
        - $ref: "#/components/schemas/EmptyObject"
    RollbackSettings:
      oneOf:
        - type: object
          properties:
            rollbackEnabled:
              type: boolean
            rollbackRetries:
              type: number
            rollbackTimeout:
              type: number
          required:
            - rollbackEnabled
        - $ref: "#/components/schemas/EmptyObject"
    SniSettings:
      oneOf:
        - type: object
          properties:
            disableSNIRouting:
              type: boolean
          required:
            - disableSNIRouting
        - $ref: "#/components/schemas/EmptyObject"
    TlsSettings:
      oneOf:
        - type: object
          properties:
            defaultCipherList:
              type: string
            defaultEcdhCurve:
              type: string
            maxVersion:
              type: string
            minVersion:
              type: string
            rejectUnauthorized:
              type: boolean
          required:
            - defaultCipherList
            - defaultEcdhCurve
            - maxVersion
            - minVersion
            - rejectUnauthorized
        - $ref: "#/components/schemas/EmptyObject"
    UpgradeGroupSettings:
      type: object
      properties:
        isRolling:
          type: boolean
        quantity:
          type: number
        retryCount:
          type: number
        retryDelay:
          type: number
      title: UpgradeGroupSettings
    UpgradePackageUrls:
      type: object
      properties:
        packageHashUrl:
          type: string
        packageUrl:
          type: string
      required:
        - packageUrl
    UpgradeSettings:
      type: object
      properties:
        automaticUpgradeCheckPeriod:
          type: string
        disableAutomaticUpgrade:
          type: boolean
        enableLegacyEdgeUpgrade:
          type: boolean
        packageUrls:
          type: array
          items:
            $ref: "#/components/schemas/UpgradePackageUrls"
        upgradeSource:
          type: string
    SystemSettingsConf:
      type: object
      properties:
        api:
          $ref: "#/components/schemas/ApiTypeSystemSettingsConf"
        apps:
          $ref: "#/components/schemas/AppsTypeSystemSettingsConf"
        backups:
          $ref: "#/components/schemas/BackupsSettings"
        customLogo:
          $ref: "#/components/schemas/CustomLogoTypeSystemSettingsConf"
        pii:
          $ref: "#/components/schemas/PiiSettings"
        proxy:
          $ref: "#/components/schemas/ProxyTypeSystemSettingsConf"
        rollback:
          $ref: "#/components/schemas/RollbackSettings"
        shutdown:
          $ref: "#/components/schemas/ShutdownTypeSystemSettingsConf"
        sni:
          $ref: "#/components/schemas/SniSettings"
        sockets:
          $ref: "#/components/schemas/SocketsTypeSystemSettingsConf"
        support:
          $ref: "#/components/schemas/SupportTypeSystemSettingsConf"
        system:
          $ref: "#/components/schemas/SystemTypeSystemSettingsConf"
        tls:
          $ref: "#/components/schemas/TlsSettings"
        upgradeGroupSettings:
          $ref: "#/components/schemas/UpgradeGroupSettings"
        upgradeSettings:
          $ref: "#/components/schemas/UpgradeSettings"
        workers:
          $ref: "#/components/schemas/WorkersTypeSystemSettingsConf"
      required:
        - api
        - backups
        - pii
        - proxy
        - rollback
        - shutdown
        - sni
        - system
        - tls
        - upgradeGroupSettings
        - upgradeSettings
        - workers
    CountedGitSettings:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitSettings"
    GitOpsType:
      type: string
      enum:
        - none
        - pull
        - push
      x-speakeasy-unknown-values: allow
    GitSettings:
      type: object
      properties:
        authType:
          type: string
          description: "Authentication method used for Git operations with the remote
            repository.<br/><br/> <code>none</code>: No authentication
            (anonymous access or token-in-URL).<br/> <code>ssh</code>: SSH
            key-based authentication with an SSH private key.<br/>
            <code>basic</code>: Basic authentication with username and password
            (or personal access token)."
        autoAction:
          type: string
          enum:
            - commit
            - commitPush
            - none
            - push
          description: "Automatic action to perform as defined for
            <code>autoActionSchedule</code>.<br/><br/> <code>none</code>: No
            scheduled Git actions<br/> <code>commit</code>: Scheduled commit
            only.<br/> <code>push</code>: Scheduled push only.<br/>
            <code>commitPush</code>: Scheduled commit followed by push."
          x-speakeasy-unknown-values: allow
        autoActionMessage:
          type: string
          description: Message for automatic Git commit actions. Use if
            <code>autoAction</code> is <code>commit</code> or
            <code>commitPush</code>.
        autoActionSchedule:
          type: string
          description: "Cron expression that specifies when to execute the specified
            <code>autoAction</code>. Use unless <code>autoAction: none</code>."
        branch:
          type: string
          description: The Git branch to use.
        commitDeploySingleAction:
          type: boolean
          description: If <code>true</code>, deploys are triggered on a single-action
            commit.
        copilotAutoGitCommitMessages:
          type: boolean
          description: If <code>true</code>, Copilot automatically generates Git commit
            messages.
        defaultCommitMessage:
          type: string
          description: Default commit message for Git operations.
        gitOps:
          $ref: "#/components/schemas/GitOpsType"
          description: "Git operations mode.<br/><br/> <code>none</code>: Disable GitOps
            automation<br/> <code>push</code>: Push changes to the remote
            repository<br/> <code>pull</code>: Periodically pull changes from
            the remote repository."
        password:
          type: string
          description: "Password for Git remote authentication. Use with <code>authType:
            ssh</code."
        remote:
          type: string
          description: URL of the remote Git repository.
        sshKey:
          type: string
          description: "SSH private key for Git authentication. Use with <code>authType:
            ssh</code."
        strictHostKeyChecking:
          type: boolean
          description: "If <code>true</code>, strict host key checking is enabled for SSH
            connections. Use with <code>authType: ssh</code."
        timeout:
          type: integer
          description: Timeout for Git operations, in seconds.
        user:
          type: string
          description: "Username for Git remote authentication. Use with <code>authType:
            basic</code."
    CountedSearchSettings:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SearchSettings"
    DynamicConcurrencySettings:
      type: object
      properties:
        dynamicCap:
          type: number
        enabled:
          type: boolean
        growIntervalSecs:
          type: number
        initial:
          $ref: "#/components/schemas/NumberOrPercent"
        max:
          $ref: "#/components/schemas/NumberOrPercent"
        min:
          $ref: "#/components/schemas/NumberOrPercent"
        sampleIntervalSecs:
          type: number
        shrinkIntervalSecs:
          type: number
        targetCpuHeadroom:
          type: number
        targetMemoryHeadroom:
          type: number
        windowSecs:
          type: number
    MaxConcurrentSearchesType:
      oneOf:
        - type: number
        - type: string
          pattern: ^[0-9]+%$
    SearchSettings:
      type: object
      properties:
        compressObjectCacheArtifacts:
          type: boolean
          description: If <code>true</code>, object cache artifacts are stored compressed
            on disk.
        dynamicMaxConcurrentSearches:
          $ref: "#/components/schemas/DynamicConcurrencySettings"
          description: Configuration for the dynamic max concurrent searches feature.
        fieldSummaryMaxFields:
          type: integer
          description: Maximum number of distinct fields returned in a field summary
            response.
        fieldSummaryMaxNestedDepth:
          type: integer
          description: Maximum nesting depth when summarizing structured fields.
        maxConcurrentSearches:
          $ref: "#/components/schemas/MaxConcurrentSearchesType"
          description: Maximum number of search jobs that can run concurrently.
        maxCoordinatorReuseCount:
          type: number
          description: Number of times this coordinator process can be reused. If
            <code>0</code> coordinators are never reused.
        maxExecutorsPerSearch:
          type: integer
          description: Maximum number of executors allocated to a single search job.
        maxResultsPerSearch:
          type: integer
          description: Maximum result rows returned or persisted per job.
        maxSearchDuration:
          type: string
          pattern: ^[0-9]+(s|m|h|d|w)$
          description: Maximum duration a search job can run before it is cancelled.
        searchHistoryMaxJobs:
          type: integer
          description: Maximum number of historical search job records retained.
        searchHistoryTTL:
          type: string
          pattern: ^[0-9]+(s|m|h|d|w)$
          description: Retention period for completed search job metadata.
        searchQueueLength:
          oneOf:
            - type: number
            - type: string
              pattern: ^[0-9]+%$
          description: Maximum number of jobs that can wait in the queue for a concurrency
            slot. Accepts an absolute number or a percentage of
            <code>maxConcurrentSearches</code>.
        warmPoolSize:
          oneOf:
            - type: number
            - enum:
                - auto
              x-speakeasy-unknown-values: allow
          description: Size of the warm pool of pre-initialized executor processes kept
            ready for new search jobs. Set to <code>auto</code> to let the
            system size the pool automatically.
        writeOnlyProviderSecrets:
          type: boolean
          description: If <code>true</code>, provider secrets are write-only. Secret
            values cannot be read back through APIs or the UI.
      required:
        - compressObjectCacheArtifacts
        - fieldSummaryMaxFields
        - fieldSummaryMaxNestedDepth
        - maxConcurrentSearches
        - maxExecutorsPerSearch
        - maxResultsPerSearch
        - maxSearchDuration
        - searchHistoryMaxJobs
        - searchHistoryTTL
        - searchQueueLength
        - warmPoolSize
        - writeOnlyProviderSecrets
    CountedSystemSettings:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SystemSettings"
    JobSettings:
      type: object
      properties:
        concurrentJobLimit:
          type: number
        concurrentScheduledJobLimit:
          type: number
        concurrentSystemJobLimit:
          type: number
        concurrentSystemTaskLimit:
          type: number
        concurrentTaskLimit:
          type: number
        disableTasks:
          type: boolean
        finishedJobArtifactsLimit:
          type: number
        finishedTaskArtifactsLimit:
          type: number
        jobArtifactsReaperPeriod:
          type: string
        jobTimeout:
          type: string
        maxTaskPerc:
          type: number
        orphanedJobTTL:
          type: string
        schedulingPolicy:
          type: string
        taskHeartbeatPeriod:
          type: number
        taskManifestFlushPeriodMs:
          type: number
        taskManifestMaxBufferSize:
          type: number
        taskManifestReadBufferSize:
          type: string
        taskPollTimeoutMs:
          type: number
      required:
        - concurrentJobLimit
        - concurrentScheduledJobLimit
        - concurrentSystemJobLimit
        - concurrentSystemTaskLimit
        - concurrentTaskLimit
        - finishedJobArtifactsLimit
        - finishedTaskArtifactsLimit
        - jobArtifactsReaperPeriod
        - jobTimeout
        - maxTaskPerc
        - orphanedJobTTL
        - schedulingPolicy
        - taskHeartbeatPeriod
        - taskManifestFlushPeriodMs
        - taskManifestMaxBufferSize
        - taskManifestReadBufferSize
        - taskPollTimeoutMs
    EdgeHeartbeatMetricsMode:
      type: string
      enum:
        - minimal
        - basic
        - all
        - custom
      x-speakeasy-unknown-values: allow
    HbConnectionMode:
      type: string
      enum:
        - auto
        - persistent
        - ephemeral
      x-speakeasy-unknown-values: allow
    Limits:
      type: object
      properties:
        bundleDownloadTimeoutSeconds:
          type: number
        cpuProfileTTL:
          type: string
        defaultHeartbeatSeconds:
          type: number
        disableMetricsAccessorCache:
          type: boolean
        edgeMetricsCustomExpression:
          type: string
        edgeMetricsMode:
          $ref: "#/components/schemas/EdgeHeartbeatMetricsMode"
        edgeNodesCount:
          type: number
        enableMetricsPersistence:
          type: boolean
        enableProcessInfoUsingWindowsTools:
          type: boolean
        enableWorkerInMemory:
          type: boolean
        eventsMetadataSources:
          type: array
          items:
            type: string
        hbConnectionMode:
          $ref: "#/components/schemas/HbConnectionMode"
        hbOfflineDuration:
          type: string
        largeEventsThreshold:
          type: string
        lookupMaxSize:
          type: string
        lookupMaxTotalSize:
          type: string
        maxDimensionValueSize:
          type: number
        maxEPs:
          type: number
        maxMetrics:
          type: number
        maxPQSize:
          type: string
        maxReconnectInterval:
          type: string
        metricsDirectory:
          type: string
        metricsDropList:
          type: array
          items:
            type: string
        metricsFieldsBlacklist:
          type: array
          items:
            type: string
        metricsGCPeriod:
          type: string
        metricsMaxCardinality:
          type: number
        metricsMaxDiskSpace:
          type: string
        metricsNeverDropList:
          type: array
          items:
            type: string
        metricsWorkerIdBlacklist:
          type: array
          items:
            type: string
        minFreeSpace:
          type: string
        minReconnectInterval:
          type: string
        netFlowTemplateFlushInterval:
          type: number
        randomReconnectInterval:
          type: string
        rateLimitBytesPerSecond:
          type: string
        samples:
          type: object
          properties:
            maxSize:
              type: string
          required:
            - maxSize
        workerMaxMetrics:
          type: number
      required:
        - cpuProfileTTL
        - enableMetricsPersistence
        - metricsDirectory
        - metricsFieldsBlacklist
        - metricsGCPeriod
        - metricsNeverDropList
        - metricsWorkerIdBlacklist
        - minFreeSpace
        - samples
    RedisCacheLimits:
      type: object
      properties:
        clientTrackingMechanism:
          type: string
        enableServerAssist:
          type: boolean
        keyTTLSecs:
          type: number
        maxCacheSize:
          type: number
        maxNumKeys:
          type: number
        servicePeriodSecs:
          type: number
    RedisConnectionLimits:
      type: object
      properties:
        disabled:
          type: boolean
        maxConnections:
          type: number
    RedisLimits:
      type: object
      properties:
        connections:
          $ref: "#/components/schemas/RedisConnectionLimits"
      required:
        - connections
    ServiceProcsType:
      oneOf:
        - type: number
        - enum:
            - auto
          x-speakeasy-unknown-values: allow
    ConnectionProxyLimitConfigs:
      type: object
      properties:
        procs:
          $ref: "#/components/schemas/ServiceProcsType"
    CommonServiceLimitConfigs:
      type: object
      properties:
        memoryLimit:
          type: string
        procs:
          $ref: "#/components/schemas/ServiceProcsType"
      required:
        - memoryLimit
    ServicesLimits:
      type: object
      properties:
        connection_proxy:
          $ref: "#/components/schemas/ConnectionProxyLimitConfigs"
        connections:
          $ref: "#/components/schemas/CommonServiceLimitConfigs"
        metrics:
          $ref: "#/components/schemas/CommonServiceLimitConfigs"
        notifications:
          $ref: "#/components/schemas/CommonServiceLimitConfigs"
      required:
        - connections
        - metrics
        - notifications
    SystemSettings:
      type: object
      properties:
        api:
          $ref: "#/components/schemas/ApiTypeSystemSettingsConf"
        apps:
          $ref: "#/components/schemas/AppsTypeSystemSettingsConf"
        auth:
          $ref: "#/components/schemas/AuthConfig"
        backups:
          $ref: "#/components/schemas/BackupsSettings"
        customLogo:
          $ref: "#/components/schemas/CustomLogoTypeSystemSettingsConf"
        distributed:
          type: object
          properties:
            mode:
              $ref: "#/components/schemas/DistModeOptionsProvisioningTokenWithSecret"
          required:
            - mode
        fips:
          type: boolean
        git:
          $ref: "#/components/schemas/GitSettings"
        jobLimits:
          $ref: "#/components/schemas/JobSettings"
        limits:
          $ref: "#/components/schemas/Limits"
        pii:
          $ref: "#/components/schemas/PiiSettings"
        proxy:
          $ref: "#/components/schemas/ProxyTypeSystemSettingsConf"
        redisCacheLimits:
          $ref: "#/components/schemas/RedisCacheLimits"
        redisLimits:
          $ref: "#/components/schemas/RedisLimits"
        rollback:
          $ref: "#/components/schemas/RollbackSettings"
        searchLimits:
          $ref: "#/components/schemas/SearchSettings"
        servicesLimits:
          $ref: "#/components/schemas/ServicesLimits"
        shutdown:
          $ref: "#/components/schemas/ShutdownTypeSystemSettingsConf"
        sni:
          $ref: "#/components/schemas/SniSettings"
        sockets:
          $ref: "#/components/schemas/SocketsTypeSystemSettingsConf"
        support:
          $ref: "#/components/schemas/SupportTypeSystemSettingsConf"
        system:
          $ref: "#/components/schemas/SystemTypeSystemSettingsConf"
        tls:
          $ref: "#/components/schemas/TlsSettings"
        upgradeGroupSettings:
          $ref: "#/components/schemas/UpgradeGroupSettings"
        upgradeSettings:
          $ref: "#/components/schemas/UpgradeSettings"
        workers:
          $ref: "#/components/schemas/WorkersTypeSystemSettingsConf"
      required:
        - api
        - auth
        - backups
        - distributed
        - fips
        - git
        - jobLimits
        - limits
        - pii
        - proxy
        - redisCacheLimits
        - redisLimits
        - rollback
        - searchLimits
        - servicesLimits
        - shutdown
        - sni
        - system
        - tls
        - upgradeGroupSettings
        - upgradeSettings
        - workers
    CountedPublicSettings:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/PublicSettings"
    PublicSettings:
      type: object
      properties:
        apiProtocol:
          type: string
          description: "API protocol: <code>http</code> or <code>https</code>)."
        appPlatformEnabled:
          type: boolean
          description: Workspace-level App Platform kill switch. When <code>false</code>,
            the UI hides the App Platform navigation. Defaults to
            <code>true</code> when the <code>apps.enabled</code> system setting
            is unset.
        intercom:
          type: boolean
          description: If <code>true</code>, Intercom integration is enabled.
        isRegistered:
          type: boolean
          description: If <code>true</code>, the Cribl instance is registered.
      required:
        - apiProtocol
        - intercom
        - isRegistered
    CountedUpgradeResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/UpgradeResult"
    VersionInfo:
      type: object
      properties:
        architecture:
          type: string
          description: "Target architecture: <code>x64</code>, <code>arm64</code>,
            <code>universal</code>."
        build:
          type: string
          description: Build identifier, typically an eight-character hash.
        downloadUrl:
          type: string
          description: Direct download URL for the Cribl package if available for the
            version, platform, and architecture.
        fullVersion:
          type: string
          description: Version string.
          example: 4.17.0-build.123
        major:
          type: integer
          description: Major version number.
        minor:
          type: integer
          description: Minor version number.
        platform:
          type: string
          description: "Target platform: <code>linux</code>, <code>darwin</code>,
            <code>win32</code>."
        point:
          type: integer
          description: Patch version number.
        preRelease:
          type: string
          description: Pre-release identifiers for the version.
          example: beta
      required:
        - build
        - fullVersion
        - major
        - minor
    UpgradeResult:
      type: object
      properties:
        availableVersions:
          type: array
          items:
            $ref: "#/components/schemas/VersionInfo"
          description: Available versions for upgrade.
        canUpgrade:
          type: boolean
          description: If <code>true</code>, an upgrade path is available.
        installedVersion:
          $ref: "#/components/schemas/VersionInfo"
          description: The currently installed version.
        isSuccess:
          type: boolean
          description: If <code>true</code>, the upgrade completed successfully.
        message:
          type: string
          description: Status message that describes the upgrade result.
        upgradedToVersion:
          $ref: "#/components/schemas/VersionInfo"
          description: The version that was successfully upgraded to.
      required:
        - availableVersions
        - canUpgrade
        - installedVersion
        - isSuccess
        - message
        - upgradedToVersion
    CountedSystemReloadResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SystemReloadResponse"
    SystemReloadResponse:
      type: object
      properties:
        status:
          type: string
          const: success
          description: Status of the reload operation. Always <code>success</code> for
            successful reloads.
      required:
        - status
    CountedSystemRestartResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SystemRestartResponse"
    SystemRestartResponse:
      type: object
      properties:
        restart:
          type: boolean
          const: true
          description: Restart operation initiated.
      required:
        - restart
    UpgradeMasterRequest:
      type: object
      properties:
        packages:
          title: Custom Path
          description: Provide your own URLs or local paths for platform-specific Cribl
            packages
          type: array
          items:
            $ref: "#/components/schemas/PackageUrlConfDistributedUpgradeRequest"
    UiStatePatch:
      type: object
      required:
        - op
        - value
      properties:
        op:
          type: string
          enum:
            - set
            - push-recent
          x-speakeasy-unknown-values: allow
        value:
          oneOf:
            - type: string
              maxLength: 1000
            - type: object
            - type: array
              items:
                oneOf:
                  - type: string
                    maxLength: 1000
                  - type: object
        args:
          type:
            - object
          additionalProperties: true
    CountedBranchInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/BranchInfo"
    BranchInfo:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier.
      required:
        - id
    GitCommitBody:
      type: object
      properties:
        effective:
          type: boolean
        files:
          type: array
          items:
            type: string
        message:
          type: string
      required:
        - message
    CurrentBranchResult:
      type: object
      properties:
        branch:
          type: string
      required:
        - branch
    CountedGitInfo:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitInfo"
    GitInfo:
      type: object
      properties:
        remote:
          oneOf:
            - type: string
            - enum:
                - false
              x-speakeasy-unknown-values: allow
        versioning:
          type: boolean
      required:
        - remote
        - versioning
    CountedGitLogResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitLogResult"
    GitLogResult:
      type: object
      properties:
        author_email:
          type: string
        author_name:
          type: string
        body:
          type: string
        date:
          type: string
        hash:
          type: string
        message:
          type: string
        refs:
          type: string
    CountedGitStatusResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitStatusResult"
    GitStatusResult:
      type: object
      properties:
        ahead:
          type: number
        behind:
          type: number
        conflicted:
          type: array
          items:
            type: string
        created:
          type: array
          items:
            type: string
        current:
          type: string
        deleted:
          type: array
          items:
            type: string
        files:
          type: array
          items:
            type: object
            properties:
              index:
                type: string
              path:
                type: string
              working_dir:
                type: string
            required:
              - index
              - path
              - working_dir
        modified:
          type: array
          items:
            type: string
        not_added:
          type: array
          items:
            type: string
        renamed:
          type: array
          items:
            type: object
            properties:
              from:
                type: string
              to:
                type: string
            required:
              - from
              - to
        staged:
          type: array
          items:
            type: string
      required:
        - ahead
        - behind
        - conflicted
        - created
        - current
        - deleted
        - files
        - modified
        - not_added
        - renamed
        - staged
    CountedGitSyncResult:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/GitSyncResult"
    GitSyncResult:
      type: object
      properties:
        branch:
          type: string
          description: Name of the Git branch that was synchronized.
        synced:
          type: boolean
          description: If <code>true</code>, the synchronization was successful.
            Otherwise, <code>false</code>.
        version:
          type: string
          description: Configuration version after synchronization, if available.
      required:
        - branch
        - synced
    CountedBoolean:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            type: boolean
    AiDatasetIntelligence:
      type: object
      properties:
        content:
          type: string
          description: Markdown intelligence summary generated by the dataset intelligence
            agent. Omitted while <code>status</code> is <code>processing</code>
            or <code>failed</code> with no partial output.
        datasetId:
          type: string
          description: Dataset that this intelligence file describes.
        failureReason:
          type: string
          description: Explanation populated when <code>status</code> is
            <code>partial</code> or <code>failed</code>.
        generatedAt:
          type: number
          description: Unix epoch milliseconds when the agent run was started.
        status:
          type: string
          enum:
            - complete
            - failed
            - partial
            - processing
          description: Lifecycle status of the intelligence file. <code>processing</code>
            = agent is running, <code>complete</code> = all sections populated,
            <code>partial</code> = some tools failed but useful content was
            produced, <code>failed</code> = no meaningful analysis could be
            produced.
          x-speakeasy-unknown-values: allow
        updatedAt:
          type: number
          description: Unix epoch milliseconds of the most recent user edit through
            <code>PATCH</code>, if any.
      required:
        - datasetId
        - generatedAt
        - status
    AiEventProxyRequest:
      type: object
      additionalProperties: true
    AiSettingsEmptyResponse:
      type: object
      additionalProperties: false
    AiAgentsMdProduct:
      type: string
      const: search
    AiAgentsMdContentResponse:
      type: object
      properties:
        content:
          type: string
          description: Markdown content in the agents.md file for the product.
      required:
        - content
    ModelTierAssignment:
      type: object
      properties:
        frontier:
          type: string
        reasoning:
          type: array
          items:
            type: string
        small:
          type: string
    AiCustomProviderPublic:
      type: object
      properties:
        configuration:
          type: object
          additionalProperties: true
          description: Custom AI Provider-specific configuration, with sensitive
            information omitted.
        description:
          type: string
          description: Brief description for the custom AI Provider.
        id:
          type: string
          description: Unique identifier for the custom AI Provider.
        name:
          type: string
          enum:
            - azure
            - bedrock
            - litellm
            - openai_compatible
          description: Type of the custom AI Provider.
          x-speakeasy-unknown-values: allow
        tiers:
          $ref: "#/components/schemas/ModelTierAssignment"
          description: Per-tier model assignments for this provider.
      required:
        - configuration
        - id
        - name
    AiCustomProviderGetResponse:
      type: object
      properties:
        provider:
          $ref: "#/components/schemas/AiCustomProviderPublic"
          description: Present when a custom AI Provider is configured.
    AiDisabledResponse:
      type: object
      properties:
        disabled:
          type: boolean
          description: If <code>true</code>, AI features are disabled for the deployment.
      required:
        - disabled
    AiFeatureValueResponse:
      type: object
      properties:
        value:
          type: boolean
          description: If <code>true</code>, the AI feature is enabled. If
            <code>false</code>, the AI feature is disabled.
      required:
        - value
    AiSettings:
      type: object
      properties:
        copilot_chatbot:
          type: boolean
          description: If <code>true</code>, enable the Copilot Widget (chatbot FAB). If
            <code>false</code>, disable it.
        schematizer:
          type: boolean
          description: If <code>true</code>, enable the Copilot Editor (Schematizer). If
            <code>false</code>, disable it.
        background_detection:
          type: boolean
          description: If <code>true</code>, enable Guard background detection. If
            <code>false</code>, disable it.
        agentic_search:
          type: boolean
          description: If <code>true</code>, enable Investigations (agentic search). If
            <code>false</code>, disable it.
        web_search:
          type: boolean
          description: If <code>true</code>, enable Investigations web search. If
            <code>false</code>, disable it.
      description: Map of AI feature keys to their enabled (<code>true</code>) or
        disabled (<code>false</code>) state for the deployment. Each property is
        an independently toggleable AI capability.
    CountedMcpServerGetResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/MCPServerGetResponse"
    MCPServerConfigPublic:
      type: object
      properties:
        displayName:
          type: string
        enabled:
          type: boolean
        headers:
          type: object
          additionalProperties:
            type: string
        id:
          type: string
        url:
          type: string
      required:
        - id
        - url
    MCPServerGetResponse:
      type: object
      properties:
        server:
          $ref: "#/components/schemas/MCPServerConfigPublic"
      required:
        - server
    CountedMcpServersListResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/MCPServersListResponse"
    MCPServersListResponse:
      type: object
      properties:
        count:
          type: number
        items:
          type: array
          items:
            $ref: "#/components/schemas/MCPServerConfigPublic"
      required:
        - count
        - items
    BooleanRecord:
      type: object
      additionalProperties:
        type: boolean
    AiFeaturesBulkPartialFailureResponse:
      type: object
      properties:
        error:
          type: string
          description: Summary error message.
        errors:
          type: array
          items:
            type: string
          description: Per-feature or validation error messages.
        results:
          $ref: "#/components/schemas/BooleanRecord"
          description: Feature successfully updated before the failure.
      required:
        - error
        - errors
        - results
    MCPServerConfig:
      type: object
      properties:
        displayName:
          type: string
        enabled:
          type: boolean
        headers:
          type: object
          additionalProperties:
            type: string
        id:
          type: string
        url:
          type: string
      required:
        - id
        - url
    MCPServersPutRequest:
      type: object
      properties:
        servers:
          type: array
          items:
            $ref: "#/components/schemas/MCPServerConfig"
      required:
        - servers
    AiAgentsMdContentRequest:
      type: object
      properties:
        content:
          type: string
          description: Markdown content for the agents.md file for the product.
      required:
        - content
    AiProvider:
      type: object
      properties:
        configuration:
          type: object
          additionalProperties: true
          description: Provider-specific configuration object.
        description:
          type: string
          description: Description of this provider configuration.
        id:
          type: string
          description: Unique identifier for the AI provider configuration.
        name:
          type: string
          enum:
            - azure
            - bedrock
            - litellm
            - openai_compatible
          description: AI provider backend. <code>bedrock</code> for Amazon Bedrock;
            <code>azure</code> for Azure OpenAI / Foundry; <code>litellm</code>
            for a LiteLLM proxy; <code>openai_compatible</code> for any
            OpenAI-compatible server.
          x-speakeasy-unknown-values: allow
        tiers:
          $ref: "#/components/schemas/ModelTierAssignment"
          description: Per-tier model assignments for this provider.
      required:
        - configuration
        - id
        - name
    AiDatasetIntelligenceUpdateRequest:
      type: object
      properties:
        content:
          type: string
          description: Replacement markdown content for the dataset intelligence file.
      required:
        - content
    AiFeatureToggleRequest:
      type: object
      properties:
        value:
          type: boolean
          description: To enable the AI feature, <code>true</code>. To disable the AI
            feature, <code>false</code>.
      required:
        - value
    Consent:
      type: object
      properties:
        accepted:
          type: boolean
          description: If <code>true</code>, consent is granted to use AI features for the
            deployment. If <code>false</code>, consent is declined.
        id:
          type: string
          description: Unique identifier for the deployment.
        initialized:
          type: boolean
          description: If <code>true</code>, consent state has been initialized.
      required:
        - accepted
        - id
        - initialized
    ConsentListResponse:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/Consent"
          description: Consent records; typically a single element with current state.
      required:
        - items
    AiConsentUpdateRequest:
      type: object
      properties:
        accepted:
          type: boolean
          description: If <code>true</code>, consent is granted to use AI features for the
            deployment. If <code>false</code>, consent is declined.
      required:
        - accepted
    CountedDsdAvailableLogSourcesApiResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DsdAvailableLogSourcesApiResponse"
    DsdDiscoveredLogDestinationApi:
      type: object
      properties:
        configurationStatus:
          type: string
          enum:
            - configured
            - not_configured
          description: Whether a matching Cribl Source exists for the log source.
          x-speakeasy-unknown-values: allow
        destination_arn:
          type:
            - "null"
            - string
          description: ARN of the log source (S3 bucket or Firehose delivery stream). Null
            if no log source is configured.
        destination_http_endpoint_url:
          type: string
          description: HTTP endpoint URL for the Firehose stream configured on the log
            source.
        destination_sqs_queue_arn:
          type: string
          description: ARN of the SQS queue configured on the log source.
        destination_sqs_queue_url:
          type: string
          description: URL of the SQS queue configured on the log source.
        destination_type:
          type: string
          enum:
            - firehose
            - s3
          description: Cribl Source type.
          examples:
            - s3
            - firehose
          x-speakeasy-unknown-values: allow
        forwarding_eventbridge:
          type: boolean
          description: Whether the S3 bucket forwards <code>s3:ObjectCreated</code> events
            to EventBridge.
        forwarding_sqs_queue_arns:
          type: array
          items:
            type: string
          description: ARNs of the SQS queues the S3 bucket forwards
            <code>s3:ObjectCreated</code> events to (one per notification).
        log_category:
          type: string
          description: Category of logs produced by the source service.
        matchedInputId:
          type: string
          description: "The <code>id</code> of the Cribl Source that ingests from the log
            source. Present only when <code>configurationStatus:
            configured</code>."
          example: in_s3_aws_logs
        region:
          type: string
          description: Region of the discovered log source (scanner-provided string).
        source_arn:
          type: string
          description: ARN of the AWS resource that produces the logs.
        source_kind:
          type: string
          description: Type of AWS resource.
        source_service:
          type: string
          description: AWS service that produces the discovered logs.
      required:
        - configurationStatus
        - destination_arn
        - destination_type
    DsdAvailableLogSourcesApiResponse:
      type: object
      properties:
        discoveredDestinations:
          type: array
          items:
            $ref: "#/components/schemas/DsdDiscoveredLogDestinationApi"
          description: Discovered log sources, each with configuration status indicating
            whether a matching Cribl Source exists.
        loggingDestinationsArtifactFound:
          type: boolean
          description: If <code>true</code>, the latest scan produced log source results.
        nextCursor:
          type: string
          description: Opaque token for fetching the next page of results. Absent when no
            more pages are available.
        runTimestamp:
          type: integer
          description: Timestamp (in Unix time) of the latest Data Source Discovery (DSD)
            scan, in milliseconds.
      required:
        - discoveredDestinations
        - loggingDestinationsArtifactFound
    CountedDsdErrorBody:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DsdErrorBody"
    DsdErrorBody:
      type: object
      properties:
        message:
          type: string
          description: Human-readable error message.
      required:
        - message
    DsdCfnReadPermissionsRequestBody:
      type: object
      properties:
        connectionId:
          type: string
      required:
        - connectionId
    CountedDsdConfigureInputsResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DsdConfigureInputsResponse"
    GeneratorId:
      type: string
      enum:
        - cfn-integration
        - cfn-bootstrap
      x-speakeasy-unknown-values: allow
    DsdProvisioningArtifact:
      type: object
      properties:
        content:
          type: string
          description: Artifact payload (YAML text for CloudFormation artifacts).
        generatorId:
          $ref: "#/components/schemas/GeneratorId"
          description: Generator id that produced this artifact (for example,
            <code>cfn-integration</code>).
          example: cfn-integration
        kind:
          type: string
          description: Stable kind discriminator (for example, <code>cloudformation</code>).
          example: cloudformation
      required:
        - content
        - generatorId
        - kind
    DsdCfnIntegrationFirehoseEndpoint:
      type: object
      properties:
        accessKey:
          type: string
          description: Access key for the Cribl HTTP endpoint.
        endpointUrl:
          type: string
          description: URL for the Cribl HTTP endpoint.
      required:
        - accessKey
        - endpointUrl
    DsdLoggingDestinationInput:
      type: object
      properties:
        destination_arn:
          type:
            - "null"
            - string
          description: ARN of the S3 bucket or Firehose delivery stream. Omit if the
            template should create a new bucket or stream.
        destination_http_endpoint_url:
          type: string
          description: Optional customer-routable HTTP(S) endpoint URL for Firehose
            delivery streams. Use when the Cribl listener binds all interfaces
            (0.0.0.0) and CloudFormation must reference the external ingress
            host and port visible to Firehose.
          minLength: 8
          maxLength: 2048
        destination_name:
          type: string
          description: Human-readable name of the S3 bucket or Firehose delivery stream.
        destination_type:
          type: string
          enum:
            - firehose
            - s3
          description: Cribl Source type. Omit to use the default for the Cribl Source for
            the cloud resource type.
          examples:
            - s3
            - firehose
          x-speakeasy-unknown-values: allow
        firehose:
          $ref: "#/components/schemas/DsdCfnIntegrationFirehoseEndpoint"
          description: Cribl HTTP endpoint configuration for a new Firehose delivery
            stream. Required when no <code>destination_arn</code> is provided.
        log_category:
          type: string
          description: Category of logs produced by the source service.
        overrides:
          type: object
          additionalProperties:
            type: string
          description: Overrides for CloudFormation template parameter defaults.
        source_arn:
          type: string
          description: ARN of the AWS resource that produces the logs.
        source_kind:
          type: string
          description: Type of cloud resource.
          example: trail
        source_service:
          type: string
          description: Cloud service that produces the logs. Valid values align with
            supported integration source services.
          examples:
            - cloudtrail
            - vpc
        stsExternalId:
          type: string
          description: STS external ID for the integration IAM role. Generated
            automatically if omitted.
      required:
        - log_category
        - source_arn
        - source_kind
        - source_service
    DsdConfigureInputsResponse:
      type: object
      properties:
        artifacts:
          type: array
          items:
            $ref: "#/components/schemas/DsdProvisioningArtifact"
          description: Ordered provisioning artifacts produced by the generator registry.
            The first element is the CloudFormation integration template (YAML).
        integrations:
          type: array
          items:
            $ref: "#/components/schemas/DsdLoggingDestinationInput"
          description: Integration rows after server-side normalization, Firehose
            credential merge, and deterministic derived ARNs where applicable.
        pullBatchConfigureJobId:
          type:
            - "null"
            - string
          description: S3 batch-configure job id for the asynchronous pull phase; poll
            <code>GET /system/dsd/configure-inputs/jobs/{jobId}</code>.
        pushBatchConfigureJobId:
          type:
            - "null"
            - string
          description: Firehose batch-configure job id when the blocking push phase ran;
            null when nothing was enqueued for Firehose.
        resourceSuffix:
          type: string
          description: Resource suffix echoed for stack parameter alignment with generated
            template resources.
        warnings:
          type: array
          items:
            type: string
          description: Optional operator-visible notices (non-fatal conditions).
      required:
        - artifacts
        - integrations
        - pullBatchConfigureJobId
        - pushBatchConfigureJobId
        - resourceSuffix
    DsdConfigureInputsRequestBody:
      type: object
      properties:
        accountId:
          type: string
          description: Target AWS account id for discovered resources (12 decimal digits
            when <code>cloud</code> is AWS).
          pattern: ^[0-9]{12}$
        cloud:
          type: string
          const: AWS
          description: Cloud provider (Data Source Discovery scan family).
          example: AWS
        criblInputAssumeRolePrincipalArn:
          type: string
          description: Optional default for template parameter
            <code>CriblInputAssumeRolePrincipalArn</code>.
        groupId:
          type: string
          description: Cribl Stream worker group id where Sources are created.
          pattern: ^[a-zA-Z0-9_\\-]+$
        integrations:
          type: array
          items:
            $ref: "#/components/schemas/DsdLoggingDestinationInput"
          description: Integration rows after discovery (same shape as CloudFormation
            integration generation).
        userParamsByIntegrationIndex:
          type: array
          items:
            type: object
            additionalProperties: true
          description: "Optional parallel array to <code>integrations</code>: per-row
            Source <code>userParams</code> for S3 batch-configure. When
            provided, length must match <code>integrations.length</code>."
      required:
        - accountId
        - cloud
        - groupId
        - integrations
    CountedDsdConnectionWriteResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DsdConnectionWriteResponse"
    DsdAccountFilterType:
      type: string
      enum:
        - NONE
        - INTERSECTION
        - DIFFERENCE
      x-speakeasy-unknown-values: allow
    DsdConnectionKind:
      type: string
      enum:
        - aws_account
        - aws_organization
      x-speakeasy-unknown-values: allow
    DsdStoredConnection:
      type: object
      properties:
        accountFilterType:
          $ref: "#/components/schemas/DsdAccountFilterType"
        accountId:
          type: string
        cloud:
          type: string
          const: AWS
        connectedAt:
          type: number
        discoveredAccounts:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/AdditionalPropertiesTypeDsdStoredConnectionDiscover\
              edAccounts"
        displayName:
          type: string
        excludeAccountIds:
          type: array
          items:
            type: string
        includeAccountIds:
          type: array
          items:
            type: string
        kind:
          $ref: "#/components/schemas/DsdConnectionKind"
        lastDataScanAt:
          type:
            - "null"
            - number
        lastOrgInventoryScanAt:
          type:
            - "null"
            - number
        organizationalUnitIds:
          type: array
          items:
            type: string
        pendingOrgInventoryRunId:
          type:
            - "null"
            - number
        serviceRoleName:
          type: string
      required:
        - accountId
        - cloud
        - connectedAt
        - kind
        - serviceRoleName
    DsdConnectionWriteResponse:
      type: object
      properties:
        connection:
          $ref: "#/components/schemas/DsdStoredConnection"
          description: Stored connection record after the operation.
        id:
          type: string
          description: Stable connection id assigned when the connection is registered.
          example: aws-account-prod
      required:
        - connection
        - id
    CountedDsdConfigureInputsJobGetResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DsdConfigureInputsJobGetResponse"
    DsdBatchConfigureItemResult:
      type: object
      properties:
        destination_arn:
          type: string
          description: ARN of the S3 bucket or Firehose delivery stream.
        error:
          type: object
          properties:
            code:
              type: number
            message:
              type: string
          required:
            - code
            - message
          description: "Error details. Included when <code>status: error</code>."
        id:
          type: string
          description: "The <code>id</code> of the Cribl Source. Included when
            <code>status: ok</code>."
          example: in_firehose_aws_logs
        source_arn:
          type: string
          description: ARN of the AWS resource that produces the logs.
        status:
          type: string
          enum:
            - error
            - ok
          description: Result status for the log source configuration.
          x-speakeasy-unknown-values: allow
      required:
        - status
      title: DsdBatchConfigureItemResult
    DsdBatchConfigureJobStatus:
      type: string
      enum:
        - cancelled
        - completed
        - failed
        - queued
        - running
      description: Terminal and in-progress states for a persisted DSD batch-configure job.
      x-speakeasy-unknown-values: allow
    DsdConfigureInputsJobGetResponse:
      type: object
      properties:
        accountId:
          type: string
          description: Cloud account ID.
        cloud:
          type: string
          const: AWS
          description: Cloud provider.
        createdAt:
          type: string
          description: Timestamp (ISO 8601) when the job was created.
        jobId:
          type: string
          description: Batch-configure job ID.
        lastError:
          type: string
          description: Error message if the job failed.
        processed:
          type: integer
          description: Number of items processed so far.
        results:
          type: array
          items:
            oneOf:
              - type: "null"
              - $ref: "#/components/schemas/DsdBatchConfigureItemResult"
          description: Per-item results in request order. Null entries are not yet
            processed.
        status:
          $ref: "#/components/schemas/DsdBatchConfigureJobStatus"
          description: Job lifecycle status.
        total:
          type: integer
          description: Number of items in the request.
        updatedAt:
          type: string
          description: Timestamp (ISO 8601) when the job was last updated.
      required:
        - accountId
        - cloud
        - createdAt
        - jobId
        - processed
        - results
        - status
        - total
        - updatedAt
    CountedDsdListConnectionsApiResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DsdListConnectionsApiResponse"
    DsdListConnectionsApiResponse:
      type: object
      properties:
        connections:
          type: object
          additionalProperties:
            type: object
            properties:
              accountFilterType:
                $ref: "#/components/schemas/DsdAccountFilterType"
              accountId:
                type: string
              cloud:
                type: string
                const: AWS
              connectedAt:
                type: number
              discoveredAccounts:
                type: object
                additionalProperties:
                  $ref: "#/components/schemas/AdditionalPropertiesTypeDsdStoredConnectionDiscover\
                    edAccounts"
              displayName:
                type: string
              excludeAccountIds:
                type: array
                items:
                  type: string
              includeAccountIds:
                type: array
                items:
                  type: string
              kind:
                $ref: "#/components/schemas/DsdConnectionKind"
              lastDataScanAt:
                type:
                  - "null"
                  - number
              lastOrgInventoryScanAt:
                type:
                  - "null"
                  - number
              organizationalUnitIds:
                type: array
                items:
                  type: string
              pendingOrgInventoryRunId:
                type:
                  - "null"
                  - number
              serviceRoleName:
                type: string
            required:
              - accountId
              - cloud
              - connectedAt
              - kind
              - serviceRoleName
          description: Map of connection id to stored connection metadata.
      required:
        - connections
    CountedDsdAsyncActionAcceptedResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DsdAsyncActionAcceptedResponse"
    DsdAsyncActionAcceptedResponse:
      type: object
      properties:
        message:
          type: string
          description: Confirmation message.
      required:
        - message
    DsdOrgInventoryScanRequestBody:
      type: object
      properties:
        connectionId:
          type: string
          description: Unique identifier of the Data Source Discovery (DSD) connection to
            scan.
          example: 8be4df61-93ca-11d2-aa0d-00e098032b8c
      required:
        - connectionId
    RegisterDsdAwsAccountPayload:
      type: object
      properties:
        accountId:
          type: string
        cloud:
          type: string
          const: AWS
        displayName:
          type: string
        kind:
          type: string
          const: aws_account
        serviceRoleName:
          type: string
        stsExternalId:
          type: string
      required:
        - accountId
        - cloud
        - kind
        - serviceRoleName
      title: RegisterDsdAwsAccountPayload
    RegisterDsdAwsOrganizationPayload:
      type: object
      properties:
        accountFilterType:
          $ref: "#/components/schemas/DsdAccountFilterType"
        accountId:
          type: string
        cloud:
          type: string
          const: AWS
        displayName:
          type: string
        excludeAccountIds:
          type: array
          items:
            type: string
        includeAccountIds:
          type: array
          items:
            type: string
        kind:
          type: string
          const: aws_organization
        organizationalUnitIds:
          type: array
          items:
            type: string
        serviceRoleName:
          type: string
        stsExternalId:
          type: string
      required:
        - accountId
        - cloud
        - kind
        - organizationalUnitIds
        - serviceRoleName
      title: RegisterDsdAwsOrganizationPayload
    RegisterDsdConnectionPayload:
      oneOf:
        - $ref: "#/components/schemas/RegisterDsdAwsAccountPayload"
        - $ref: "#/components/schemas/RegisterDsdAwsOrganizationPayload"
    DsdDataScanServiceEntry:
      type: object
      properties:
        rate:
          type: integer
          description: Maximum API calls per second for the service scan operations.
          minimum: 0
        regions:
          type: array
          items:
            $ref: "#/components/schemas/RegionConfDsdDataScanServiceEntry"
          description: List of regions to limit the scan to for the service.
        service:
          type: string
          description: Cloud service to scan (for example <code>s3</code> or
            <code>ec2</code>).
          examples:
            - s3
            - ec2
      required:
        - service
    DsdDataScanRequestBody:
      type: object
      properties:
        accountId:
          type: string
          description: Cloud provider account ID.
          pattern: ^[0-9]{12}$
          example: "123456789012"
        cloud:
          type: string
          const: AWS
          description: Cloud provider.
          example: AWS
        organizationId:
          type: string
          description: Management account ID for AWS Organization connections.
          example: "123456789012"
        region:
          type: string
          enum:
            - af-south-1
            - ap-east-1
            - ap-northeast-1
            - ap-northeast-2
            - ap-northeast-3
            - ap-south-1
            - ap-south-2
            - ap-southeast-1
            - ap-southeast-2
            - ap-southeast-3
            - ap-southeast-4
            - ap-southeast-5
            - ap-southeast-7
            - ca-central-1
            - ca-west-1
            - eu-central-1
            - eu-central-2
            - eu-north-1
            - eu-south-1
            - eu-south-2
            - eu-west-1
            - eu-west-2
            - eu-west-3
            - il-central-1
            - me-central-1
            - me-south-1
            - sa-east-1
            - us-east-1
            - us-east-2
            - us-gov-east-1
            - us-gov-west-1
            - us-west-1
            - us-west-2
          description: Region for the scan control plane.
          x-speakeasy-unknown-values: allow
        regions:
          type: array
          items:
            $ref: "#/components/schemas/RegionConfDsdDataScanServiceEntry"
          description: Regions to scan. Omit to scan all regions.
        services:
          type: array
          items:
            $ref: "#/components/schemas/DsdDataScanServiceEntry"
          description: Per-service scan options (regions and rate limits). Omit to scan
            all supported services across all regions.
      required:
        - accountId
        - cloud
    CountedDsdGetScanStatusApiResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/DsdGetScanStatusApiResponse"
    DsdStatusApiResponse:
      type: object
      properties:
        error:
          type: string
          description: Optional diagnostic when present and phase is not the filtered
            failure payload.
        estimatedTimeRemainingSeconds:
          type: integer
          description: Estimated seconds remaining until all slices finish (heuristic from
            the leader).
        percentComplete:
          type: number
          description: Approximate completion percentage for the latest run.
        phase:
          type: string
          description: Scanner phase when present.
          examples:
            - running
            - complete
        runTimestamp:
          type: integer
          description: Milliseconds since Unix epoch for the latest run folder (S3 path
            segment).
      required:
        - estimatedTimeRemainingSeconds
        - percentComplete
        - runTimestamp
      title: DsdStatusApiResponse
    DsdScanFailedStatusApiResponse:
      type: object
      properties:
        error:
          type: string
          description: Static user-facing guidance; internal failure details from
            status.json are not returned.
        phase:
          type: string
          const: failed
          description: Terminal failure phase.
          example: failed
      required:
        - error
        - phase
      title: DsdScanFailedStatusApiResponse
    DsdGetScanStatusApiResponse:
      oneOf:
        - $ref: "#/components/schemas/DsdStatusApiResponse"
        - $ref: "#/components/schemas/DsdScanFailedStatusApiResponse"
    UpdateDsdAwsAccountPayload:
      type: object
      properties:
        displayName:
          type: string
        kind:
          type: string
          const: aws_account
        serviceRoleName:
          type: string
        stsExternalId:
          type: string
      required:
        - kind
      title: UpdateDsdAwsAccountPayload
    UpdateDsdAwsOrganizationPayload:
      type: object
      properties:
        accountFilterType:
          $ref: "#/components/schemas/DsdAccountFilterType"
        accountId:
          type: string
        displayName:
          type: string
        excludeAccountIds:
          type: array
          items:
            type: string
        includeAccountIds:
          type: array
          items:
            type: string
        kind:
          type: string
          const: aws_organization
        organizationalUnitIds:
          type: array
          items:
            type: string
        serviceRoleName:
          type: string
        stsExternalId:
          type: string
      required:
        - kind
      title: UpdateDsdAwsOrganizationPayload
    UpdateDsdConnectionPayload:
      oneOf:
        - $ref: "#/components/schemas/UpdateDsdAwsAccountPayload"
        - $ref: "#/components/schemas/UpdateDsdAwsOrganizationPayload"
    CountedCriblLakeSource:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/CriblLakeSource"
    CriblLakeSource:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the Cribl Lake Source.
        sourceType:
          type: string
          enum:
            - ddss
            - http
          description: "Type of the Cribl Lake Source.<br/><br/> <code>ddss</code>: DDSS
            bucket<br/> <code>http</code>: Direct Access HTTP Source."
          x-speakeasy-unknown-values: allow
        status:
          $ref: "#/components/schemas/CriblLakeLifecycleItemStatus"
          description: Provisioning status of the Cribl Lake Source. Automatically
            populated and returned in responses.
      required:
        - id
        - sourceType
    PreviewResponseBody:
      type: object
      properties:
        count:
          type: integer
          description: Number of events in the response.
        events:
          type: array
          items:
            $ref: "#/components/schemas/EventConfPreviewResponseBody"
          description: Events that were produced by running the preview query over the
            input sample.
        processingTimeMS:
          type: integer
          description: Processing time for the preview, in milliseconds.
        useFormattedVisualization:
          type: boolean
          description: If <code>true</code>, the preview output should use chart or
            formatted visualization.
      required:
        - count
        - events
        - processingTimeMS
        - useFormattedVisualization
    DatatypePreviewInput:
      oneOf:
        - type: object
          properties:
            dataset:
              type: string
            type:
              type: string
              const: dataset
          required:
            - dataset
            - type
        - type: object
          properties:
            rawData:
              type: string
            type:
              type: string
              const: rawData
          required:
            - rawData
            - type
    DatatypePreviewRequestBody:
      type: object
      properties:
        eventBreakerRule:
          $ref: "#/components/schemas/EventBreakerRule"
          description: Optional Event Breaker rule.
        input:
          $ref: "#/components/schemas/DatatypePreviewInput"
          description: Preview input source.
      required:
        - input
    KustoDocsCatalogEntry:
      type: object
      properties:
        kind:
          type: string
          description: Category of the topic. Corresponds to the <code>kind</code> field
            on the topic.
        name:
          type: string
          description: Identifier for the topic. Corresponds to the <code>name</code>
            field on the topic.
      required:
        - kind
        - name
    KustoDocsCatalogSection:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: "#/components/schemas/KustoDocsCatalogEntry"
          description: Topics that are listed under the section.
        label:
          type: string
          description: Section heading for catalog navigation.
      required:
        - items
        - label
    KustoTopicDoc:
      type: object
      properties:
        kind:
          type: string
          description: Category of the topic, such as operator, function, or datatype.
        longDescription:
          type: string
          description: Full description of the topic.
        markdownSource:
          type: string
          description: Markdown source for the topic body, when available.
        metadata:
          type: object
          properties:
            parameters:
              type: array
              items:
                type: object
                properties:
                  description:
                    type: string
                    description: Brief description of the parameter.
                  name:
                    type: string
                    description: Name of the parameter.
                required:
                  - description
                  - name
              description: Parameters for functions or similar constructs.
          required:
            - parameters
          description: Structured metadata for the topic, such as function parameters.
        name:
          type: string
          description: Identifier for the topic within its category.
        shortDescription:
          type: string
          description: Short description of the topic.
        url:
          type: string
          description: Link to external or product documentation for the topic.
      required:
        - kind
        - longDescription
        - name
        - shortDescription
    KustoDocs:
      type: object
      properties:
        catalog:
          type: array
          items:
            $ref: "#/components/schemas/KustoDocsCatalogSection"
          description: Catalog entries that are grouped by category for navigation.
        docs:
          type: array
          items:
            $ref: "#/components/schemas/KustoTopicDoc"
          description: Searchable topics from the documentation bundle, including
            operators, functions, and datatypes.
      required:
        - catalog
        - docs
    CountedSearchHealthCheckStatus:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SearchHealthCheckStatus"
    SearchHealthCheckStatus:
      oneOf:
        - type: object
          properties:
            reported_at:
              type: integer
              description: Timestamp (in Unix time) for when the snapshot was recorded
                (milliseconds).
            status:
              type: string
              const: green
              description: Health check status. Returns <code>green</code> when the check
                succeeds.
          required:
            - reported_at
            - status
        - type: object
          properties:
            reason:
              type: string
              enum:
                - QUEUE_NOT_HEALTHY
                - SERVICE_UNAVAILABLE
                - STATUS_CHECK_FAILED
              description: Cause of failure for the health check.
              x-speakeasy-unknown-values: allow
            reported_at:
              type: integer
              description: Timestamp (in Unix time) for when the snapshot was recorded
                (milliseconds).
            status:
              type: string
              const: red
              description: Health check status. Returns <code>red</code> when the check fails.
          required:
            - reason
            - reported_at
            - status
    SearchJobResultsJobInfo:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the search job.
        query:
          type: string
          description: Kusto query text as submitted before macro expansion and
            server-side normalization.
        earliest:
          type:
            - string
            - number
          description: Lower bound of the search time window; relative string or Unix
            seconds, aligned with <code>earliest</code>.
          examples:
            - -24h
            - "1715000000"
        latest:
          type:
            - string
            - number
          description: Upper bound of the search time window; relative string or Unix
            seconds, aligned with <code>latest</code>.
        timeCreated:
          type: integer
          description: Job creation time in Unix epoch milliseconds.
        timeStarted:
          type: integer
          description: Time execution began, in Unix epoch milliseconds, when known.
        timeCompleted:
          type: integer
          description: Time the job reached a terminal state, in Unix epoch milliseconds,
            when known.
        status:
          $ref: "#/components/schemas/StatusOptionsSearchJob"
        pendingComputeNodeStatuses:
          $ref: "#/components/schemas/PendingComputeNodeStatusesTypeSearchJob"
        timezone:
          type: string
          description: IANA timezone for interpreting relative bounds and timestamps.
          examples:
            - America/New_York
            - UTC
        aliasOfOriginalJobId:
          type: string
          description: For deduplicated or aliased executions, the id of the canonical job
            this run points to.
      required:
        - id
        - query
        - status
        - timeCreated
    SearchResultWarning:
      type: object
      properties:
        message:
          type: string
        type:
          type: string
        usageGroupId:
          type: string
      required:
        - message
        - type
    SearchJobResults:
      type: object
      properties:
        isFinished:
          type: boolean
          description: If <code>true</code>, no further result pages will be produced for
            the search job.
        job:
          $ref: "#/components/schemas/SearchJobResultsJobInfo"
          description: Subset of job fields that describe the result set, including query,
            time bounds, and status.
        limit:
          type: integer
          description: Limit value from the request that produced the page.
        offset:
          type: integer
          description: Offset value from the request that produced the page.
        persistedEventCount:
          type: integer
          description: Number of events that are persisted for the search job. May be less
            than <code>totalEventCount</code> when capped by limits.
        totalEventCount:
          type: integer
          description: Total number of events that matched the query. May exceed the
            persisted event count.
        warnings:
          type: array
          items:
            $ref: "#/components/schemas/SearchResultWarning"
          description: Optional warnings about the result set, for example when results
            are truncated by service limits.
      required:
        - isFinished
        - job
        - offset
        - persistedEventCount
        - totalEventCount
    SearchJobStatusParam:
      type: string
      const: queued
    CountedSearchMetrics:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SearchMetrics"
    CacheMetrics:
      type: object
      properties:
        bytesScannedByCache:
          type: integer
          description: Bytes satisfied from dataset cache versus cold storage for this job
            segment.
        elapsedTimeInCacheS:
          type: number
          description: Wall-clock seconds spent serving cached bytes (cache hit path
            latency).
      required:
        - bytesScannedByCache
        - elapsedTimeInCacheS
    CoordCPUMemMetric:
      type: object
      properties:
        coordinatorReuseCount:
          type: integer
          description: Number of times this coordinator process was reused before running
            this job. <code>0</code> means first use.
          minimum: 0
          maximum: 25
        cpuPerc:
          type: integer
          description: Coordinator process CPU utilization as a percentage of one core.
        eluPerc:
          type: integer
          description: Event loop utilization percentage for the coordinator process.
        heapPerc:
          type: number
          description: Heap utilization as a percentage of the configured or observed heap
            limit.
          minimum: 0
          maximum: 100
        heapUsageBytes:
          type: integer
          description: Resident JavaScript heap size for the coordinator process, in bytes.
      required:
        - coordinatorReuseCount
        - cpuPerc
        - eluPerc
        - heapPerc
        - heapUsageBytes
    ExecutorCount:
      type: object
      properties:
        executorsAllocatedCount:
          type: integer
          description: Number of executor workers that reached an allocated (running)
            state for this job.
        executorsDispatchedCount:
          type: integer
          description: Number of executor workers dispatched for this job.
      required:
        - executorsAllocatedCount
        - executorsDispatchedCount
    ExecutionFailure:
      type: object
      properties:
        failureTime:
          type: number
        fqObjectID:
          type: string
        reason:
          type: string
      required:
        - failureTime
        - fqObjectID
        - reason
      title: ExecutionFailure
    ObjectsSkippedByPhase:
      type: object
      properties:
        list:
          type: object
          additionalProperties:
            type: number
        task:
          type: object
          additionalProperties:
            type: number
    ExecutorMetric:
      type: object
      properties:
        cpuSecsMultiplier:
          type: integer
          description: Factor applied to raw CPU-second measurements when attributing or
            billing executor CPU time.
        failureInfo:
          $ref: "#/components/schemas/FailureInfoTypeExecutorMetric"
        firstResultReceived:
          type: integer
          description: Unix epoch time (milliseconds) when the first result batch was
            received from this executor.
        id:
          type: string
        instanceTypeCode:
          type: string
          description: Compact instance type label for diagnostics.
        objectMetrics:
          type: object
          additionalProperties:
            $ref: "#/components/schemas/ObjectMetric"
          description: Per-object scan metrics for this executor, keyed by object
            identifier.
      required:
        - cpuSecsMultiplier
        - failureInfo
        - firstResultReceived
        - id
        - objectMetrics
      title: ExecutorMetric
    LaunchLatency:
      type: object
      properties:
        derived:
          type: object
          properties:
            coordRunToMarkStartedMs:
              type: number
            dequeuedToMarkStartedMs:
              type: number
            jobCreatedToDequeuedMs:
              type: number
        fromWarmPool:
          type: boolean
        segments:
          type: object
          properties:
            coordReadyToRunMs:
              type: number
            coordRunToFirstStageMs:
              type: number
            jobCreatedToPreSpawnMs:
              type: number
            preSpawnToCoordReadyMs:
              type: number
        totalMs:
          type: number
      required:
        - derived
        - fromWarmPool
        - segments
    SendMetric:
      type: object
      properties:
        bytesOut:
          type: integer
          description: Bytes written by the send operator to downstream destinations for
            this job snapshot.
        droppedEvents:
          type: integer
          description: Events dropped by the send operator due to backpressure or
            configuration.
        eventsOut:
          type: integer
          description: Events emitted by the send operator after filtering for this job
            snapshot.
      required:
        - bytesOut
        - droppedEvents
        - eventsOut
    TaskMetric:
      type: object
      properties:
        largeFileTaskCount:
          type: integer
          description: Count of completed tasks classified as large-file tasks.
        taskCompletionTimeSeconds:
          type: integer
          description: Coordinator-side CPU seconds attributed to completing allocated
            executor tasks.
        taskRequestTimeSeconds:
          type: integer
          description: Coordinator-side CPU seconds spent waiting on task RPC or scheduling.
        taskSizeBytes:
          type: integer
          description: Total bytes read or buffered while processing tasks for this job.
        tasksCompleted:
          type: integer
          description: Count of work units that finished successfully or terminally.
        tasksReceived:
          type: integer
          description: Count of work units dispatched to executors for this job.
      required:
        - taskCompletionTimeSeconds
        - taskRequestTimeSeconds
        - taskSizeBytes
        - tasksCompleted
        - tasksReceived
    ObjectMetric:
      type: object
      properties:
        bytesIn:
          type: integer
          description: Cumulative bytes read from this object so far during the scan.
        bytesOut:
          type: integer
          description: Cumulative bytes emitted upstream from this object so far (after
            processing).
        cpuSecsMultiplier:
          type: integer
          description: Optional factor applied to CPU-second measurements for this
            object-level aggregate.
        endTime:
          type: integer
          description: Unix epoch time (milliseconds) when scanning this object finished.
        eventsError:
          type: integer
          description: Count of event-level parse or validation failures for this object.
        eventsIn:
          type: integer
          description: Cumulative events read from this object so far.
        eventsOut:
          type: integer
          description: Cumulative events sent upstream after filtering for this object.
        id:
          type: string
        objectsSearched:
          type: integer
          description: Number of child objects fully searched under the metric scope.
        objectsSkipped:
          $ref: "#/components/schemas/ObjectsSkippedByPhase"
          description: Skip counts grouped by phase (<code>list</code> vs
            <code>task</code>) and reason key (for example storage class).
        startTime:
          type: integer
          description: Unix epoch time (milliseconds) when scanning this object began.
      required:
        - bytesIn
        - bytesOut
        - endTime
        - eventsError
        - eventsIn
        - eventsOut
        - id
        - objectsSearched
        - objectsSkipped
        - startTime
    SearchTraceSpan:
      type: object
      required:
        - id
        - startTime
        - status
        - children
      additionalProperties: false
      properties:
        id:
          type: string
          description: Identifier for the span.
        startTime:
          type: number
          description: Start time of the span.
        endTime:
          type: number
          description: End time of the span, when closed.
        status:
          type: string
          enum:
            - open
            - success
            - fail
          description: Lifecycle status of the span.
          x-speakeasy-unknown-values: allow
        children:
          type: object
          description: Child spans nested under the span. Each key is a path segment or
            stable identifier, and each value is a span with the same recursive
            structure.
          additionalProperties: true
    SearchMetric:
      type: object
      properties:
        cacheMetrics:
          $ref: "#/components/schemas/CacheMetrics"
          description: Cache hit and scan metrics. Present when Dataset caching applies.
        coordCpuMemMetrics:
          $ref: "#/components/schemas/CoordCPUMemMetric"
          description: CPU and memory utilization metrics for the coordinator.
        cpuMetrics:
          $ref: "#/components/schemas/CPUTimeMetric"
          description: Aggregated CPU time metrics for executors, the coordinator, and the
            full job.
        executorCountMetrics:
          $ref: "#/components/schemas/ExecutorCount"
          description: Number of executors that were dispatched and allocated for the job.
        executorsMetrics:
          type: object
          additionalProperties:
            type: object
            properties:
              cpuSecsMultiplier:
                type: integer
                description: Factor applied to raw CPU-second measurements when attributing or
                  billing executor CPU time.
              failureInfo:
                $ref: "#/components/schemas/FailureInfoTypeExecutorMetric"
              firstResultReceived:
                type: integer
                description: Unix epoch time (milliseconds) when the first result batch was
                  received from this executor.
              id:
                type: string
              instanceTypeCode:
                type: string
                description: Compact instance type label for diagnostics.
              objectMetrics:
                type: object
                additionalProperties:
                  $ref: "#/components/schemas/ObjectMetric"
                description: Per-object scan metrics for this executor, keyed by object
                  identifier.
            required:
              - cpuSecsMultiplier
              - failureInfo
              - firstResultReceived
              - id
              - objectMetrics
          description: Metrics for each executor.
        failureInfo:
          $ref: "#/components/schemas/FailureInfoTypeExecutorMetric"
        firstResultExec:
          oneOf:
            - type: "null"
            - $ref: "#/components/schemas/ExecutorMetric"
          description: Metrics for the executor that returned the first result batch.
        id:
          type: string
        lastResultExec:
          oneOf:
            - type: "null"
            - $ref: "#/components/schemas/ExecutorMetric"
          description: Metrics for the executor that returned the last result batch.
        launch:
          $ref: "#/components/schemas/LaunchLatency"
          description: "Launch-latency breakdown for the job: disjoint segments, a
            directly-measured total, and overlapping derived windows."
        objectFilterMetrics:
          type: object
          required:
            - totalObjectInfoInstances
            - matchingObjectInfoInstances
            - skippedEvents
            - skippedBytes
          additionalProperties: false
          properties:
            totalObjectInfoInstances:
              type: number
              description: Total number of objects evaluated against the filter.
            matchingObjectInfoInstances:
              type: number
              description: Number of objects that matched the filter.
            skippedEvents:
              type: number
              description: Total number of events excluded by the filter from the metadata
                manifest.
            skippedBytes:
              type: number
              description: Total number of bytes excluded by the filter from the metadata
                manifest.
        processFromWarmPool:
          type: boolean
          description: True if the coordinator process came from the warm pool (no
            cold-start cost paid for this job).
        processStartupMs:
          type: integer
          description: Wall-clock milliseconds the coordinator search process took to
            reach READY for this job.
        sendMetrics:
          $ref: "#/components/schemas/SendMetric"
          description: Metrics for data that was sent from the coordinator to clients or
            downstream stages.
        stageMetrics:
          type: object
          additionalProperties:
            type: object
            properties:
              averageExecutorCount:
                type: integer
                description: Average concurrent executors while this stage ran.
              stageExecutionSeconds:
                type: integer
                description: Wall-clock duration spent executing this stage, in seconds.
              usedAutoScaling:
                type: boolean
                description: If <code>true</code>, used autoscaling to size executors for this
                  stage. If <code>false</code>, a fixed pool was used.
            required:
              - averageExecutorCount
              - stageExecutionSeconds
              - usedAutoScaling
          description: Metrics for each pipeline stage, keyed by stage identifier.
        taskMetrics:
          $ref: "#/components/schemas/TaskMetric"
          description: Task execution counters for the search job.
        timeToFirstByte:
          type:
            - "null"
            - number
          description: Seconds from job start until the first batch of results arrived.
        totalMetrics:
          $ref: "#/components/schemas/ObjectMetric"
          description: Aggregated object-level metrics across all objects processed by the
            job.
        trace:
          $ref: "#/components/schemas/SearchTraceSpan"
          description: Hierarchical trace of the search job (spans with timing and status).
      required:
        - coordCpuMemMetrics
        - cpuMetrics
        - executorCountMetrics
        - executorsMetrics
        - failureInfo
        - firstResultExec
        - id
        - lastResultExec
        - objectFilterMetrics
        - sendMetrics
        - stageMetrics
        - taskMetrics
        - timeToFirstByte
        - totalMetrics
        - trace
    SearchMetrics:
      type: object
      properties:
        metrics:
          $ref: "#/components/schemas/SearchMetric"
      required:
        - metrics
    CountedSearchMetric:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SearchMetric"
    CountedSearchLakeDestination:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SearchLakeDestination"
    SearchLakeDestination:
      type: object
      properties:
        assumeRoleArn:
          type: string
          description: ARN of the IAM role to assume for cross-account access.
        assumeRoleExternalId:
          type: string
          description: External ID for the assumed IAM role.
        awsApiKey:
          type: string
          description: AWS access key for manual authentication.
        awsAuthenticationMethod:
          type: string
          enum:
            - auto
            - manual
            - secret
          description: AWS authentication method.
          x-speakeasy-unknown-values: allow
        awsSecretKey:
          type: string
          description: AWS secret key for manual authentication.
        bucket:
          type: string
          description: Name of the S3 bucket where data is stored.
        destPath:
          type: string
          description: Key prefix prepended to files before uploading to S3.
        enableAssumeRole:
          type: boolean
          description: If <code>true</code>, use an IAM role for cross-account access.
        endpoint:
          type: string
          description: Custom S3 endpoint URL for S3-compatible storage.
        format:
          type: string
          enum:
            - json
            - parquet
            - raw
          description: Output data format.
          x-speakeasy-unknown-values: allow
        group:
          type: string
          description: The Worker Group where the Destination is configured.
        id:
          type: string
          description: Unique identifier for the Destination.
        kmsKeyId:
          type: string
          description: KMS key ID or ARN for server-side encryption when using aws:kms.
        maxConcurrentFileParts:
          type: number
          description: Maximum number of parts to upload in parallel per file.
        maxFileIdleTimeSec:
          type: number
          description: Maximum idle time in seconds before closing a file.
        maxFileOpenTimeSec:
          type: number
          description: Maximum time in seconds to write to a file before closing.
        maxFileSizeMB:
          type: number
          description: Maximum uncompressed output file size in MB.
        maxOpenFiles:
          type: number
          description: Maximum number of files to keep open concurrently.
        objectACL:
          type: string
          description: Object ACL to assign to uploaded objects.
        partitioningFields:
          type: array
          items:
            type: string
          description: List of fields to partition the path by, in addition to time.
        region:
          type: string
          description: AWS region where the S3 bucket is located.
        rejectUnauthorized:
          type: boolean
          description: If <code>true</code>, reject unauthorized TLS certificates.
        reuseConnections:
          type: boolean
          description: If <code>true</code>, reuse HTTP connections for S3 requests.
        serverSideEncryption:
          type: string
          enum:
            - AES256
            - aws:kms
          description: Server-side encryption method for uploaded objects.
          x-speakeasy-unknown-values: allow
        stagePath:
          type: string
          description: Filesystem location where files are buffered before uploading to S3.
        storageClass:
          type: string
          description: Storage class for uploaded objects.
        type:
          type: string
          const: dl_s3
          description: Destination type. Always <code>dl_s3</code> for this endpoint.
        verifyPermissions:
          type: boolean
          description: If <code>true</code>, verify that the bucket exists on startup.
      required:
        - bucket
        - group
        - id
        - stagePath
        - type
    CountedSearchNotificationResponse:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SearchNotificationResponse"
    SearchNotificationResponse:
      type: object
      properties:
        message:
          type: string
          description: Status message indicating that the Notification was sent.
      required:
        - message
    SearchNotificationOriginMetadata:
      type: object
      properties:
        groupId:
          type: string
          description: Worker Group ID associated with the Notification. Always empty for
            Cribl Search Notifications.
        id:
          type: string
          description: Identifier for the search job that triggered the Notification.
        itemType:
          type: string
          description: How the Notification is displayed. For Cribl Search Notifications,
            always <code>link</code>, which means a clickable link to the
            originating search.
        product:
          type: string
          description: The product context. For Cribl Search Notifications, always
            <code>search</code>.
        type:
          type: string
          description: The type of entity that triggered the Notification. For Cribl
            Search Notifications, always <code>search</code>.
      required:
        - groupId
        - id
        - itemType
        - product
        - type
    SearchNotification:
      type: object
      properties:
        __attachments:
          type: array
          items:
            type: object
            additionalProperties: true
          description: Attachment details for the Notification, such as CSV or JSON files
            for email Notifications. Empty if no attachments are included.
        _raw:
          type: string
          description: The rendered Notification message. Same value as
            <code>message</code>.
        _time:
          type: integer
          description: Timestamp (in Unix time) when the Notification was generated, in
            milliseconds. Same value as <code>now</code>.
        group:
          type: string
          description: Worker Group ID where the scheduled search ran. For Cribl Search
            Notifications, always <code>default_search</code>.
        id:
          type: string
          description: Unique identifier for the Notification instance.
        message:
          type: string
          description: The rendered Notification message. Same value as <code>_raw</code>.
        notificationId:
          type: string
          description: Identifier for the Notification configuration that triggered the
            event.
        now:
          type: integer
          description: Timestamp (in Unix time) when the Notification was generated, in
            milliseconds. Same value as <code>_time</code>.
        origin_metadata:
          $ref: "#/components/schemas/SearchNotificationOriginMetadata"
          description: Metadata that describes the source of the Notification. Used to
            render navigable links in the Cribl Search messages panel.
        resultSet:
          type: array
          items:
            type: object
            additionalProperties: true
          description: Search result events included with the Notification. Present only
            when <code>includeResults</code> is enabled in the Notification
            target configuration.
        savedQueryId:
          type: string
          description: Identifier for the saved and scheduled search associated with the
            Notification.
        searchId:
          type: string
          description: Identifier for the search associated with the Notification.
        searchResultsUrl:
          type: string
          description: Direct link to the search results associated with the Notification.
        severity:
          type: string
          description: Severity level of the Notification.
        tenantId:
          type: string
          description: Identifier for the Cribl.Cloud tenant. Omitted for on-prem
            deployments.
        title:
          type: string
          description: Short title for the Notification, displayed in the Cribl Search
            messages panel.
      required:
        - __attachments
        - _raw
        - _time
        - group
        - id
        - message
        - notificationId
        - now
        - origin_metadata
        - savedQueryId
        - searchId
        - searchResultsUrl
        - severity
        - title
      description: Event payload generated when a scheduled search triggers a Cribl
        Search Notification. Sent to configured Notification targets and
        displayed in the Cribl Search messages panel.
    CountedPreviewResponseBody:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/PreviewResponseBody"
    PreviewOptions:
      type: object
      properties:
        earliest:
          type:
            - string
            - number
          description: Start of the time range for preview events. Accepts a relative time
            string or an epoch timestamp.
        latest:
          type:
            - string
            - number
          description: End of the time range for preview events. Accepts a relative time
            string or an epoch timestamp. Defaults to now.
    PreviewRequestBody:
      type: object
      properties:
        events:
          type: array
          items:
            $ref: "#/components/schemas/EventConfPreviewResponseBody"
          description: Sample events that are used as input for the preview.
        options:
          $ref: "#/components/schemas/PreviewOptions"
          description: Optional preview configuration, such as time bounds.
        query:
          type: string
          description: Query that is evaluated against the sample events.
      required:
        - events
        - query
    SearchVpcEndpointIdsSchema:
      type: array
      description: S3 interface VPC endpoint IDs for AWS regions where Cribl Search
        runs. Use these values when configuring attribute-based access control
        tags in IAM trust and permission policies.
      items:
        type: string
        description: A VPC endpoint identifier.
    CountedTrustPolicy:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/TrustPolicy"
    AMTrustPolicy:
      type: object
      properties:
        Statement:
          type: array
          items:
            type: object
            properties:
              Action:
                oneOf:
                  - type: string
                  - type: array
                    items:
                      type: string
                description: STS or IAM action granted by this statement, or a list of actions
                  when multiple are required.
              Condition:
                type: object
                properties:
                  StringEquals:
                    type: object
                    additionalProperties:
                      type: string
                    description: Map of request context field names to required string values.
                description: Optional IAM condition map.
              Effect:
                type: string
                description: IAM statement effect.
              Principal:
                type: object
                properties:
                  AWS:
                    type: string
                    description: AWS principal ARN or account identifier trusted by this statement.
                required:
                  - AWS
                description: Principal block identifying the trusted AWS identity for this
                  statement.
            required:
              - Action
              - Effect
              - Principal
          description: List of IAM policy statements.
        Version:
          type: string
          description: IAM policy version.
      required:
        - Statement
        - Version
    TrustPolicy:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the Trust Policy.
        policy:
          $ref: "#/components/schemas/AMTrustPolicy"
          description: IAM trust policy for cross-account role trust.
      required:
        - id
        - policy
    DatasetFavoritesResponse:
      type: array
      items:
        $ref: "#/components/schemas/DatasetFavorite"
    DatasetStatsResponse:
      type: object
      properties:
        byteCounts:
          type: array
          items:
            $ref: "#/components/schemas/TimeSeriesPoint"
          description: Time series of byte counts over the time window specified with the
            <code>startTime</code> and <code>endTime</code> query parameters,
            bucketed according to the specified <code>granularity</code>.
        eventCounts:
          type: array
          items:
            $ref: "#/components/schemas/TimeSeriesPoint"
          description: Time series of event counts over the time window specified with the
            <code>startTime</code> and <code>endTime</code> query parameters,
            bucketed according to the specified <code>granularity</code>.
        maxEventTime:
          type: integer
          description: Timestamp (in Unix time) for the latest event in the lakehouse
            engine Dataset, in milliseconds.
        minEventTime:
          type: integer
          description: Timestamp (in Unix time) for the earliest event in the lakehouse
            engine Dataset, in milliseconds.
        totalByteCount:
          type: integer
          description: Total number of bytes in the lakehouse engine Dataset.
        totalEventCount:
          type: integer
          description: Total number of events in the lakehouse engine Dataset.
      required:
        - byteCounts
        - eventCounts
        - maxEventTime
        - minEventTime
        - totalByteCount
        - totalEventCount
      description: Response for <code>GET /search/datasets/{id}/datasetStats</code>.
    RestApiJsonError:
      type: object
      properties:
        message:
          type: string
          description: Human-readable message or serialized validation details for the
            error.
        status:
          type: string
          const: error
          description: Always <code>error</code> for API error responses.
      required:
        - message
        - status
      description: JSON body returned for many REST failures that use
        RESTEndpoint.sendError (and similar handlers).
    DatasetUserStats:
      type: object
      properties:
        queryCount:
          type: integer
          description: Total number of queries that the user ran against the Dataset in
            the requested window.
        user:
          type: string
          description: Unique identifier of the user.
        userDisplayName:
          type: string
          description: Display name of the user.
      required:
        - queryCount
        - user
      description: Query activity for a single user of a lakehouse engine Dataset.
    DatasetUsageStatsResponse:
      type: object
      properties:
        lastQueryTime:
          type: integer
          description: Timestamp (in Unix time) of the most recent query against the
            Dataset, in milliseconds. Omitted when no usage metadata is
            available.
        queryCounts:
          type: array
          items:
            type: object
            properties:
              counts:
                type: array
                items:
                  type: object
                  properties:
                    count:
                      type: integer
                      description: Number of queries of the <code>type</code> in the bucket.
                    type:
                      type: string
                      enum:
                        - agentic
                        - command
                        - dashboard
                        - datatypePreview
                        - notebook
                        - scheduled
                        - standard
                        - systemInsights
                      description: Search job type, such as <code>standard</code>,
                        <code>scheduled</code>, or <code>dashboard</code>.
                      x-speakeasy-unknown-values: allow
                  required:
                    - count
                    - type
                description: Query counts broken down by search job type for the bucket.
              startTime:
                type: integer
                description: Timestamp (in Unix time) for the bucket start time, in
                  milliseconds.
            required:
              - counts
              - startTime
          description: Sparse histogram of query counts bucketed by the requested
            granularity. Each bucket lists counts broken down by search job
            type.
        topUsers:
          type: array
          items:
            $ref: "#/components/schemas/DatasetUserStats"
          description: Users with the most queries against the Dataset, listed in
            descending order by query count.
      required:
        - queryCounts
        - topUsers
      description: Response for <code>GET /search/datasets/{id}/usageStats</code>.
    ValueCount:
      type: object
      properties:
        count:
          type: integer
          description: Number of events that contain the <code>value</code>.
        value:
          type: string
          description: String representation of the field value.
      required:
        - count
        - value
      description: Field values and their occurrence counts.
    FieldValueTypes:
      type: object
      properties:
        array:
          type: boolean
          description: If <code>true</code>, the field contains array values.
        boolean:
          type: boolean
          description: If <code>true</code>, the field contains boolean values.
        numeric:
          type: boolean
          description: If <code>true</code>, the field contains numeric values.
        object:
          type: boolean
          description: If <code>true</code>, the field contains object values.
      required:
        - array
        - boolean
        - numeric
        - object
      description: The JSON value types that appear in a field. A field can contain
        multiple types.
    StringFieldStats:
      type: object
      properties:
        count:
          type: integer
          description: Number of events that contain the field.
        emptyCount:
          type: integer
          description: Number of events where the field is an empty string.
        name:
          type: string
          description: Name of the field.
        nullCount:
          type: integer
          description: Number of events where the field is null.
        topValues:
          type: array
          items:
            $ref: "#/components/schemas/ValueCount"
          description: Estimated most frequent values for the field.
        type:
          type: string
          const: string
          description: Deprecated. Use <code>valueTypes</code> instead.
          deprecated: true
        uniqueCount:
          type: integer
          description: Estimated number of unique values for the field.
        valueTypes:
          $ref: "#/components/schemas/FieldValueTypes"
          description: The JSON value types that appear in the field. The field can
            contain multiple types.
      required:
        - count
        - emptyCount
        - name
        - nullCount
        - topValues
        - type
        - uniqueCount
        - valueTypes
      description: Statistics for a string-type field.
      title: StringFieldStats
    NumericFieldStats:
      type: object
      properties:
        avg:
          type: number
          description: Average numeric value observed for the field.
        avgValues:
          type: array
          items:
            $ref: "#/components/schemas/TimeSeriesPoint"
          description: Time series of the average value over the time window specified
            with the <code>startTime</code> and <code>endTime</code> query
            parameters, bucketed according to the specified
            <code>granularity</code>.
        count:
          type: integer
          description: Number of events that contain the field.
        max:
          type: number
          description: Maximum numeric value observed for the field.
        min:
          type: number
          description: Minimum numeric value observed for the field.
        name:
          type: string
          description: Name of the field.
        nullCount:
          type: integer
          description: Number of events where the field is null.
        stdDev:
          type: number
          description: Sample standard deviation of the numeric values for the field.
        topValues:
          type: array
          items:
            $ref: "#/components/schemas/ValueCount"
          description: Estimated most frequent values for the field.
        type:
          type: string
          const: numeric
          description: Deprecated. Use <code>valueTypes</code> instead.
          deprecated: true
        uniqueCount:
          type: integer
          description: Estimated number of unique values for the field.
        valueTypes:
          $ref: "#/components/schemas/FieldValueTypes"
          description: The JSON value types that appear in the field. The field can
            contain multiple types.
      required:
        - avg
        - avgValues
        - count
        - max
        - min
        - name
        - nullCount
        - stdDev
        - topValues
        - type
        - uniqueCount
        - valueTypes
      description: Statistics for a numeric-type field, including min/max/avg summaries.
      title: NumericFieldStats
    FieldStatsResponse:
      type: object
      properties:
        fieldStats:
          type: array
          items:
            oneOf:
              - $ref: "#/components/schemas/StringFieldStats"
              - $ref: "#/components/schemas/NumericFieldStats"
          description: Array of per-field statistics. Each entry is either a string-type
            or numeric-type field.
        totalEventCount:
          type: integer
          description: Total number of events in the lakehouse engine Dataset over the
            time window specified with the <code>startTime</code> and
            <code>endTime</code> query parameters.
      required:
        - fieldStats
        - totalEventCount
      description: Response for <code>GET /search/datasets/{id}/fieldStats</code>.
    CountedLocalSearchApiErrorBody:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/LocalSearchApiErrorBody"
    LocalSearchApiErrorBody:
      type: object
      properties:
        message:
          type: string
          description: Human-readable message or serialized validation details for the
            error.
        status:
          type: string
          const: error
          description: Always <code>error</code> for API error responses.
      required:
        - message
        - status
      description: JSON body returned for many Local Search REST failures (via
        <code>RESTEndpoint.sendError</code> and similar handlers).
    CountedLocalSearchStatus:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/LocalSearchStatus"
    LocalSearchStatus:
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether Local Search ingestion is enabled.
        engines:
          type: array
          items:
            $ref: "#/components/schemas/LocalSearchEngine"
          description: Engines currently active for Local Search.
        estimatedIngestRate:
          type: integer
          enum:
            - 1024
            - 2048
            - 3072
            - 4096
            - 5120
            - 7168
            - 10240
            - 13312
            - 15360
          description: Combined estimated ingest rate for the Local Search worker group,
            using the same discrete ladder as Cloud Group
            <code>IConfigGroup.estimatedIngestRate</code>.
          x-speakeasy-enum-descriptions:
            - 12 MB/sec
            - 24 MB/sec
            - 36 MB/sec
            - 48 MB/sec
            - 60 MB/sec
            - 84 MB/sec
            - 120 MB/sec
            - 156 MB/sec
            - 180 MB/sec
          x-speakeasy-enums:
            - Rate12MBPerSec
            - Rate24MBPerSec
            - Rate36MBPerSec
            - Rate48MBPerSec
            - Rate60MBPerSec
            - Rate84MBPerSec
            - Rate120MBPerSec
            - Rate156MBPerSec
            - Rate180MBPerSec
          x-speakeasy-unknown-values: allow
          example: 4096
        status:
          type: string
          enum:
            - blocked
            - delayed
            - failed
            - provisioning
            - ready
            - resizing
            - terminated
          description: Lifecycle status of the Local Search configuration when present.
          x-speakeasy-unknown-values: allow
      required:
        - enabled
        - engines
        - estimatedIngestRate
      description: One row of Local Search status in the paginated GET
        <code>/search/local_search</code> response.
    LocalSearchInfraTierSize:
      type: string
      enum:
        - small
        - medium
        - large
        - xlarge
        - 2xlarge
        - 3xlarge
        - 6xlarge
      x-speakeasy-unknown-values: allow
    LocalSearchInfraStorageEntry:
      type: object
      properties:
        engineId:
          type: string
          description: Engine <code>id</code> this storage row applies to.
        tierSize:
          $ref: "#/components/schemas/LocalSearchInfraTierSize"
          description: Target infrastructure storage tier derived from engine size.
      required:
        - engineId
        - tierSize
      description: Per-engine storage tier row for infrastructure orchestration.
    LocalSearchInfraWorkerSync:
      type: object
      properties:
        estimatedIngestGB:
          type: integer
          enum:
            - 1024
            - 2048
            - 3072
            - 4096
            - 5120
            - 7168
            - 10240
            - 13312
            - 15360
          description: Estimated ingest rate used for worker sizing, aligned to the same
            discrete ladder as Cloud Group
            <code>IConfigGroup.estimatedIngestRate</code> (despite the
            historical <code>GB</code> suffix on this field name).
          x-speakeasy-enum-descriptions:
            - 12 MB/sec
            - 24 MB/sec
            - 36 MB/sec
            - 48 MB/sec
            - 60 MB/sec
            - 84 MB/sec
            - 120 MB/sec
            - 156 MB/sec
            - 180 MB/sec
          x-speakeasy-enums:
            - Rate12MBPerSec
            - Rate24MBPerSec
            - Rate36MBPerSec
            - Rate48MBPerSec
            - Rate60MBPerSec
            - Rate84MBPerSec
            - Rate120MBPerSec
            - Rate156MBPerSec
            - Rate180MBPerSec
          x-speakeasy-unknown-values: allow
          example: 1024
      required:
        - estimatedIngestGB
      description: Worker sizing inputs for Local Search infrastructure sync (GET
        <code>/search/local_search/config</code>).
    LocalSearchInfraSyncPayload:
      type: object
      properties:
        storage:
          type: array
          items:
            $ref: "#/components/schemas/LocalSearchInfraStorageEntry"
          description: Per-engine storage rows; empty array when clearing infrastructure
            state.
        worker:
          $ref: "#/components/schemas/LocalSearchInfraWorkerSync"
          description: Worker sizing when engines are active; omitted when clearing
            infrastructure state.
      required:
        - storage
      description: "Operator-only payload for GET
        <code>/search/local_search/config</code>: worker sizing and per-engine
        storage tiers for infra sync."
    LocalSearchCaptureParams:
      type: object
      properties:
        captureId:
          type: string
          description: User-specified identifier for the capture to use in the request
            body for a <code>POST /search/local_search/capture/stop</code>. If
            omitted, the server may assign a <code>captureId</code>.
        datasetRuleset:
          $ref: "#/components/schemas/DatasetRuleset"
          description: "Draft Dataset ruleset to apply during capture. Required when the
            specified capture <code>level</code> includes Dataset detection
            (<code>level: 2</code>)."
        datasets:
          type: array
          items:
            type: string
          description: Dataset IDs to restrict the capture to. If omitted, events are not
            filtered by Dataset.
        datatypeAiAutoDetected:
          type: boolean
          description: If <code>true</code>, the capture includes only events whose
            datatype was auto-detected by the catch-all rule.
        datatypeRuleset:
          $ref: "#/components/schemas/DatatypeRuleset"
          description: "Draft datatype ruleset to apply during capture. Required when the
            specified capture <code>level</code> includes datatyping
            (<code>level: 1</code> or greater)."
        datatypes:
          type: array
          items:
            type: string
          description: Datatype IDs to restrict the capture to. If omitted, events are not
            filtered by datatype.
        dropped:
          type: boolean
          description: If <code>true</code>, the capture includes only events that were
            dropped by Dataset rules (events with no assigned Dataset) and the
            <code>datasets</code> setting is ignored.
        duration:
          type: integer
          description: Amount of time to keep capture open, in seconds. If not provided,
            the default is 5 seconds.
          minimum: 1
        filter:
          type: string
          description: JavaScript expression evaluated against each event to determine
            whether an event is included in the capture output. Expressions can
            reference any event field and use logical operators. If not
            provided, all events are captured.
        hideInternalFields:
          type: boolean
          description: If <code>true</code>, internal fields that start with
            <code>__</code> are stripped from captured events.
        level:
          type: integer
          enum:
            - 0
            - 1
            - 2
          description: Stage at which events are captured. <br><code>0</code> == At source
            <br><code>1</code> == After datatyping <br><code>2</code> == After
            Dataset detection.
          x-speakeasy-enum-descriptions:
            - At source
            - After datatyping
            - After dataset detection
          x-speakeasy-enums:
            - AtSource
            - AfterDatatypingRules
            - AfterDatasetDetectionRules
          x-speakeasy-unknown-values: allow
        maxEvents:
          type: integer
          description: Maximum number of events to capture. If not provided, the default
            is 100.
          minimum: 1
          maximum: 10000
        orphaned:
          type: boolean
          description: If <code>true</code>, the capture includes only events with an
            invalid or unresolvable Dataset. These are events that arrived with
            a Dataset value that does not exist or is no longer valid.
        sources:
          type: array
          items:
            type: string
          description: Filter captured events to only those from these Source IDs. If
            omitted, events from all Sources are captured.
        stepDuration:
          type: integer
          description: How long to wait before increasing the capture sample size. Specify
            <code>1</code> second or longer. If not provided, the default is 5
            seconds.
        uncategorized:
          type: boolean
          description: If <code>true</code>, the capture includes only events with no
            datatype or a datatype of <code>Uncategorized</code>. These are
            events that were not classified by any datatype rule.
        workerId:
          type: string
          description: Unique ID of the Worker.
        workerThreshold:
          type: integer
          description: Maximum number of Workers that can capture initially. A value of
            <code>0</code> means unlimited (all available Workers can capture).
            If not provided, the default is 50.
      required:
        - duration
        - filter
        - level
        - maxEvents
      description: "Start a lakehouse engine capture: pipeline stage, optional draft
        rulesets, and event filters (<code>POST
        /search/local_search/capture</code>)."
    LocalSearchCaptureStopRequest:
      type: object
      properties:
        captureId:
          type: string
          description: Capture session ID returned or echoed from the
            <code>captureId</code> value in the request body for <code>POST
            /search/local_search/capture</code>.
      description: Stop a streaming lakehouse engine capture by <code>captureId</code>
        using <code>POST /search/local_search/capture/stop</code>).
    SupportedLocalSearchSourceType:
      type: string
      enum:
        - cribl_http
        - elastic
        - open_telemetry
        - splunk
        - splunk_hec
        - syslog
        - wef
        - prometheus_rw
        - datadog_agent
        - http_raw
        - tcpjson
        - tcp
        - wiz_webhook
      x-speakeasy-unknown-values: allow
    LocalSearchSourceDocsInline:
      oneOf:
        - $ref: "#/components/schemas/LocalSearchSourceDocsInlineTypeTextWithTextConstrai\
            nt"
        - $ref: "#/components/schemas/LocalSearchSourceDocsInlineTypeBreakConstraint"
        - $ref: "#/components/schemas/LocalSearchSourceDocsInlineTypeEmphasisWithChildren\
            Constraint"
        - type: object
          properties:
            children:
              type: array
              items:
                $ref: "#/components/schemas/LocalSearchSourceDocsInline"
            href:
              type: string
            type:
              type: string
              const: link
          required:
            - children
            - href
            - type
      description: Inline content extracted from a Local Search source documentation page.
    LocalSearchSourceDocsTab:
      type: object
      properties:
        blocks:
          type: array
          items:
            $ref: "#/components/schemas/LocalSearchSourceDocsBlock"
          description: Content blocks rendered inside the tab panel.
        label:
          type: string
          description: Display label shown on the tab.
      required:
        - blocks
        - label
      description: A single tab within a tabbed content block extracted from a Local
        Search source documentation page.
    LocalSearchSourceDocsBlock:
      oneOf:
        - type: object
          properties:
            blocks:
              type: array
              items:
                $ref: "#/components/schemas/LocalSearchSourceDocsBlock"
            type:
              type: string
              const: blockquote
          required:
            - blocks
            - type
        - type: object
          properties:
            language:
              type: string
            text:
              type: string
            type:
              type: string
              const: code
          required:
            - text
            - type
        - type: object
          properties:
            id:
              type: string
            level:
              type: number
            text:
              type: string
            type:
              type: string
              const: heading
          required:
            - id
            - level
            - text
            - type
        - $ref: "#/components/schemas/LocalSearchSourceDocsInlineTypeBreakConstraint"
        - type: object
          properties:
            items:
              type: array
            ordered:
              type: boolean
            type:
              type: string
              const: list
          required:
            - items
            - ordered
            - type
        - $ref: "#/components/schemas/LocalSearchSourceDocsInlineTypeEmphasisWithChildren\
            Constraint"
        - type: object
          properties:
            rows:
              type: array
            type:
              type: string
              const: table
          required:
            - rows
            - type
        - type: object
          properties:
            tabs:
              type: array
              items:
                $ref: "#/components/schemas/LocalSearchSourceDocsTab"
            type:
              type: string
              const: tabs
          required:
            - tabs
            - type
      description: Block content extracted from a Local Search source documentation page.
    LocalSearchSourceDocsHeading:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the rendered heading.
        level:
          type: number
          description: HTML heading level from the source documentation page.
        text:
          type: string
          description: Display text for the heading.
      required:
        - id
        - level
        - text
      description: Heading extracted from a Local Search source documentation page.
    LocalSearchSourceDocs:
      type: object
      properties:
        blocks:
          type: array
          items:
            $ref: "#/components/schemas/LocalSearchSourceDocsBlock"
          description: Structured content blocks rendered in the Documentation tab.
        canonicalUrl:
          type: string
          description: Public Cribl Docs URL used as the canonical source for the
            documentation content.
        headings:
          type: array
          items:
            $ref: "#/components/schemas/LocalSearchSourceDocsHeading"
          description: Headings used to build the Documentation tab table of contents.
        sourceType:
          type: string
          enum:
            - cribl_http
            - datadog_agent
            - elastic
            - http_raw
            - open_telemetry
            - prometheus_rw
            - splunk
            - splunk_hec
            - syslog
            - tcp
            - tcpjson
            - wef
            - wiz_webhook
          description: Local Search source type that the documentation content describes.
          x-speakeasy-unknown-values: allow
      required:
        - blocks
        - canonicalUrl
        - headings
        - sourceType
      description: Structured documentation content for a Local Search source type.
    CountedLocalSearchSource:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/LocalSearchSource"
    TLSConfig:
      type: object
      properties:
        certPath:
          type: string
          description: Filesystem or cloud path to the certificate PEM.
        disabled:
          type: boolean
          description: When true, TLS is not terminated on this listener.
        minVersion:
          $ref: "#/components/schemas/SecureVersion"
          description: Minimum TLS protocol version.
          example: TLSv1.2
        privKeyPath:
          type: string
          description: Filesystem or cloud path to the private key PEM.
      required:
        - disabled
      description: TLS listener settings for Local Search sources (paths often use
        cloud substitution tokens).
    LocalSearchSource:
      type: object
      properties:
        authTokens:
          type: array
          items:
            type: object
            properties:
              description:
                type: string
                description: Optional label for this token.
              enabled:
                type: boolean
                description: When false, the token is rejected.
              token:
                type: string
                description: Secret token string clients must present.
            required:
              - token
          description: Optional bearer or shared tokens accepted by this source.
        description:
          type: string
          description: Optional description shown in configuration UIs.
        disabled:
          type: boolean
          description: When true, the source does not accept new connections.
        host:
          type: string
          description: Bind address for the listener.
        id:
          type: string
          description: Source configuration id.
        metadata:
          type: array
          items:
            $ref: "#/components/schemas/EventBreakerRuleFields"
        port:
          type: integer
          description: TCP port when the source type uses a single port field.
        status:
          type: object
          properties:
            health:
              type: string
              description: Summary health label for the source process.
            metrics:
              type: object
              properties:
                numEventProcessors:
                  type: integer
                  description: Active event processor tasks.
                numInProgress:
                  type: integer
                  description: Events currently being processed.
              required:
                - numEventProcessors
                - numInProgress
              description: Lightweight counters for in-flight work.
            timestamp:
              type: integer
              description: Epoch milliseconds when this snapshot was taken.
          required:
            - health
            - metrics
            - timestamp
          description: Last known health snapshot from the worker, when available.
        tls:
          $ref: "#/components/schemas/TLSConfig"
          description: TLS material and policy for this listener (shape varies by source
            type).
        type:
          type: string
          enum:
            - cribl_http
            - datadog_agent
            - elastic
            - http_raw
            - open_telemetry
            - prometheus_rw
            - splunk
            - splunk_hec
            - syslog
            - tcp
            - tcpjson
            - wef
            - wiz_webhook
          description: Protocol discriminator selecting the ingest source protocol and
            listener shape.
          x-speakeasy-unknown-values: allow
          example: splunk_hec
      required:
        - host
        - id
        - type
      description: "Ingest source for Local Search: listen address, optional auth
        tokens, TLS, and health metadata
        (<code>/search/local_search/sources</code>)."
    CountedSystemInsightsHealthCheckStatus:
      type: object
      properties:
        count:
          type: integer
          description: number of items present in the items array
        items:
          type: array
          description: List of items in this response.
          items:
            $ref: "#/components/schemas/SystemInsightsHealthCheckStatus"
    SystemInsightsHealthCheckStatus:
      oneOf:
        - type: object
          properties:
            reported_at:
              type: number
            status:
              type: string
              const: green
          required:
            - reported_at
            - status
        - type: object
          properties:
            reason:
              type: string
              enum:
                - METRIC_STORE_UNAVAILABLE
                - STATUS_CHECK_FAILED
              x-speakeasy-unknown-values: allow
            reported_at:
              type: number
            status:
              type: string
              const: red
          required:
            - reason
            - reported_at
            - status
    AdditionalPropertiesTypeEnrichedFieldsSavedState:
      type: object
      required:
        - data
      properties:
        data:
          type: object
          additionalProperties: true
    EventBreakerTypeOptionsEventBreakerExistingOrNewNew:
      type: string
      title: Event Breaker type
      enum:
        - regex
        - json
        - json_array
        - header
        - timestamp
        - csv
        - aws_cloudtrail
        - aws_vpcflow
        - azure_flowlog
      x-speakeasy-enum-descriptions:
        - Regex
        - JSON Newline Delimited
        - JSON Array
        - File Header
        - Timestamp
        - CSV
        - AWS CloudTrail
        - AWS VPC Flow Log
        - Azure VNet Flow Log
      x-speakeasy-unknown-values: allow
    TimestampTypeOptionsEventBreakerExistingOrNewNewTimestamp:
      type: string
      title: Timestamp type
      enum:
        - auto
        - format
        - current
      x-speakeasy-unknown-values: allow
    EventBreakerExistingOrNewNewTimestampType:
      oneOf:
        - $ref: "#/components/schemas/EventBreakerExistingOrNewNewTimestampTypeAuto"
        - $ref: "#/components/schemas/EventBreakerExistingOrNewNewTimestampTypeFormat"
        - $ref: "#/components/schemas/EventBreakerExistingOrNewNewTimestampTypeCurrent"
      discriminator:
        propertyName: type
        mapping:
          auto: "#/components/schemas/EventBreakerExistingOrNewNewTimestampTypeAuto"
          format: "#/components/schemas/EventBreakerExistingOrNewNewTimestampTypeFormat"
          current: "#/components/schemas/EventBreakerExistingOrNewNewTimestampTypeCurrent"
    MinimumTlsVersionOptionsRedisDeploymentTypeStandaloneTlsOptions:
      type: string
      title: Minimum TLS version
      description: Minimum TLS version to use when connecting
      enum:
        - TLSv1
        - TLSv1.1
        - TLSv1.2
        - TLSv1.3
      x-speakeasy-unknown-values: allow
    MaximumTlsVersionOptionsRedisDeploymentTypeStandaloneTlsOptions:
      type: string
      title: Maximum TLS version
      description: Maximum TLS version to use when connecting
      enum:
        - TLSv1
        - TLSv1.1
        - TLSv1.2
        - TLSv1.3
      x-speakeasy-unknown-values: allow
    RootNodeConfRedisDeploymentTypeCluster:
      type: object
      required:
        - host
        - port
      properties:
        host:
          type: string
          title: Hostname
          description: "Hostname of cluster node. Must be a JavaScript expression (which
            can evaluate to a constant value), enclosed in quotes or backticks.
            Can be evaluated only at init time. Example referencing a Global
            Variable: `myBucket-${C.vars.myVar}`."
        port:
          type: number
          title: Port
          description: Port of cluster node
    ScaleReadsOptionsRedisDeploymentTypeCluster:
      title: Scale reads
      type: string
      description: Which nodes read commands should be sent to
      enum:
        - master
        - replica
        - all
      x-speakeasy-enum-descriptions:
        - Masters
        - Replicas
        - Masters and Replicas
      x-speakeasy-unknown-values: allow
    RegexListConfSerdeTypeRegex:
      type: object
      required:
        - regex
      properties:
        regex:
          type: string
          title: Regex
          description: Regex literal with named capturing groups, such as (?<foo>bar), or
            _NAME_ and _VALUE_ capturing groups, such as (?<_NAME_0>[^
            =]+)=(?<_VALUE_0>[^,]+)
          minLength: 1
    PatternListConfSerdeTypeGrok:
      type: object
      required:
        - pattern
      properties:
        pattern:
          type: string
          title: Pattern
          description: "Grok pattern to extract fields. Syntax supported:
            %{PATTERN_NAME:FIELD_NAME}"
    PrivacyProtocolOptionsSnmpTrapSerializeV3UserAuthProtocolNotNone:
      type: string
      enum:
        - none
        - des
        - aes
        - aes256b
        - aes256r
      x-speakeasy-enum-descriptions:
        - None
        - DES
        - AES128
        - AES256b (Blumenthal)
        - AES256r (Reeder)
      title: Privacy protocol
      x-speakeasy-unknown-values: allow
    AddConfFunctionConfSchemaAggregation:
      type: object
      required:
        - value
      properties:
        name:
          type: string
          title: Name
        value:
          type: string
          title: Value Expression
          description: JavaScript expression to compute the value (can be constant)
    TemplateTargetPairConfFunctionConfSchemaNotificationPolicies:
      type: object
      required:
        - templateId
        - targetId
      properties:
        templateId:
          type: string
          title: Template ID
          description: ID of the notification template to use
        targetId:
          type: string
          title: Target ID
          description: ID of the notification target (output)
    OtlpVersionOptions:
      type: string
      title: OTLP version
      enum:
        - 0.10.0
        - 1.3.1
      x-speakeasy-enum-descriptions:
        - 0.10.0
        - 1.3.1
      x-speakeasy-unknown-values: allow
    TypeOptions:
      title: Type
      description: Parser or formatter type to use
      type: string
      enum:
        - csv
        - elff
        - clf
        - kvp
        - json
        - delim
        - regex
        - grok
      x-speakeasy-enum-descriptions:
        - CSV
        - Extended Log File Format
        - Common Log Format
        - Key=Value Pairs
        - JSON Object
        - Delimited values
        - Regular Expression
        - Grok
      x-speakeasy-unknown-values: allow
    AuthenticationProtocolOptionsV3User:
      type: string
      enum:
        - none
        - md5
        - sha
        - sha224
        - sha256
        - sha384
        - sha512
      x-speakeasy-enum-descriptions:
        - None
        - MD5
        - SHA1
        - SHA224
        - SHA256
        - SHA384
        - SHA512
      title: Authentication protocol
      x-speakeasy-unknown-values: allow
    CertificateTypeAzureBlobAuthTypeClientCert:
      type: object
      required:
        - certificateName
      properties:
        certificateName:
          type: string
          title: Certificate
          description: The certificate you registered as credentials for your app in the
            Azure portal
    HiddenDefaultBreakersOptionsDatabaseCollectorConf:
      type: string
      title: Hidden Default Breakers
      enum:
        - Cribl
      x-speakeasy-unknown-values: allow
    CollectRequestParamConfHealthCheckCollectMethodPost:
      type: object
      required:
        - name
        - value
      properties:
        name:
          title: Name
          type: string
          description: Parameter name.
        value:
          title: Value
          type: string
          description: JavaScript expression to compute the parameter value (can be a
            constant).
    AuthRequestHeaderConfHealthCheckAuthenticationLogin:
      type: object
      required:
        - name
        - value
      properties:
        name:
          type: string
          title: Name
          description: Header name.
        value:
          type: string
          title: Value
          description: JavaScript expression to compute the header value (can be a
            constant).
    AuthRequestParamConfHealthCheckAuthenticationOauth:
      type: object
      required:
        - name
        - value
      properties:
        name:
          title: Name
          type: string
          description: Parameter name.
        value:
          title: Value
          type: string
          description: JavaScript expression to compute the parameter's value, normally
            enclosed in backticks (e.g., `${earliest}`). If a constant, use
            single quotes (e.g., 'earliest'). Values without delimiters
            (e.g., earliest) are evaluated as strings.
    AuthRequestHeaderConfHealthCheckAuthenticationOauth:
      type: object
      required:
        - name
        - value
      properties:
        name:
          type: string
          title: Name
          description: Header name.
        value:
          type: string
          title: Value
          description: JavaScript expression to compute the header's value, normally
            enclosed in backticks (e.g., `${earliest}`). If a constant, use
            single quotes (e.g., 'earliest'). Values without delimiters
            (e.g., earliest) are evaluated as strings.
    DiscoverMethodOptionsHealthCheckDiscoveryDiscoverTypeHttp:
      type: string
      title: Discover method
      description: Discover HTTP method.
      enum:
        - get
        - post
        - post_with_body
      x-speakeasy-enum-descriptions:
        - GET
        - POST
        - POST with Body
      x-speakeasy-unknown-values: allow
    RetryTypeOptionsHealthCheckCollectorConfRetryRules:
      type: string
      title: Retry type
      description: The algorithm to use when performing HTTP retries
      enum:
        - none
        - backoff
        - static
      x-speakeasy-enum-descriptions:
        - Disabled
        - Backoff
        - Static
      x-speakeasy-unknown-values: allow
    CollectRequestParamConfRestCollectMethodGet:
      type: object
      required:
        - name
        - value
      properties:
        name:
          title: Name
          type: string
        value:
          title: Value
          type: string
          description: JavaScript expression to compute parameter value, usually enclosed
            in backticks (`${earliest}`). If a constant, use single quotes
            ('earliest'). Values that aren't successfully evaluated as
            JavaScript expressions will be treated as string constants.
    DiscoverMethodOptionsRestDiscoveryDiscoverTypeHttp:
      type: string
      title: Discover method
      enum:
        - get
        - post
        - post_with_body
        - other
      x-speakeasy-enum-descriptions:
        - GET
        - POST
        - POST with Body
        - Other
      x-speakeasy-unknown-values: allow
    PaginationOptionsRestDiscoveryDiscoverTypeHttpPagination:
      type: string
      title: Pagination
      enum:
        - none
        - response_body
        - response_header
        - response_header_link
        - request_offset
        - request_page
      x-speakeasy-enum-descriptions:
        - None
        - Response Body Attribute
        - Response Header Attribute
        - RFC 5988 - Web Linking
        - Offset/Limit
        - Page/Size
      x-speakeasy-unknown-values: allow
    RestDiscoveryDiscoverTypeHttpPaginationType:
      oneOf:
        - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationTypeNone"
        - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationTypeResponse\
            Body"
        - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationTypeResponse\
            Header"
        - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationTypeResponse\
            HeaderLink"
        - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationTypeRequestO\
            ffset"
        - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationTypeRequestP\
            age"
      discriminator:
        propertyName: type
        mapping:
          none: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationTypeNone"
          response_body: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationTyp\
            eResponseBody"
          response_header: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationT\
            ypeResponseHeader"
          response_header_link: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPagina\
            tionTypeResponseHeaderLink"
          request_offset: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationTy\
            peRequestOffset"
          request_page: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationType\
            RequestPage"
    AuthenticationMethodOptionsS3CollectorConf:
      type: string
      title: Authentication method
      description: AWS authentication method. Choose Auto to use IAM roles.
      enum:
        - auto
        - manual
        - secret
      x-speakeasy-enum-descriptions:
        - Auto
        - Manual
        - Secret Key pair
      x-speakeasy-unknown-values: allow
    OutputModeOptionsSplunkCollectorConf:
      type: string
      title: Output mode
      description: Format of the returned output
      enum:
        - csv
        - json
      x-speakeasy-unknown-values: allow
    InputCollectionOriginDataSourceDiscoveryWithDestinationArnConstraint:
      type: object
      title: Input provenance
      description: Read-only metadata that records how the Source was created.
        Preserved on update when omitted from the request body. Cannot be set on
        create.
      additionalProperties: false
      properties:
        origin:
          type: string
          enum:
            - data_source_discovery
          description: Feature that created the Source.
          x-speakeasy-unknown-values: allow
        destinationArn:
          type: string
          description: ARN of the S3 bucket or Firehose delivery stream configured as the
            Source.
        sourceArn:
          type: string
          description: ARN of the AWS resource that produces the logs.
      readOnly: true
    ConnectionConfInputCollection:
      type: object
      properties:
        pipeline:
          title: Pipeline or Pack
          type: string
        output:
          title: Destination
          type: string
    ModeOptionsPq:
      type: string
      title: Mode
      description: With Smart mode, PQ will write events to the filesystem only when
        it detects backpressure from the processing engine. With Always On mode,
        PQ will always write events directly to the queue before forwarding them
        to the processing engine.
      enum:
        - smart
        - always
      x-speakeasy-enum-descriptions:
        - Smart
        - Always On
      x-speakeasy-unknown-values: allow
    CompressionOptionsPq:
      type: string
      enum:
        - none
        - gzip
      x-speakeasy-enum-descriptions:
        - None
        - Gzip
      title: Compression
      description: Codec to use to compress the persisted data
      x-speakeasy-unknown-values: allow
    PreprocessType:
      type: object
      required:
        - disabled
      properties:
        disabled:
          type: boolean
          title: Disabled
        command:
          type: string
          title: Command
          description: Command to feed the data through (via stdin) and process its output
            (stdout)
        args:
          type: array
          title: Arguments
          description: Arguments to be added to the custom command
          items:
            type: string
    MetadataConfInputCollection:
      type: object
      required:
        - name
        - value
      properties:
        name:
          type: string
          title: Field Name
        value:
          type: string
          title: Value
          description: JavaScript expression to compute field's value, enclosed in quotes
            or backticks. (Can evaluate to a constant.)
    OauthParamConfInputKafka:
      type: object
      required:
        - name
        - value
      properties:
        name:
          type: string
          title: Parameter Name
        value:
          type: string
          title: Parameter Value
    MinimumTlsVersionOptionsTls:
      type: string
      title: Minimum TLS version
      enum:
        - TLSv1
        - TLSv1.1
        - TLSv1.2
        - TLSv1.3
      x-speakeasy-unknown-values: allow
    MaximumTlsVersionOptionsTls:
      type: string
      title: Maximum TLS version
      enum:
        - TLSv1
        - TLSv1.1
        - TLSv1.2
        - TLSv1.3
      x-speakeasy-unknown-values: allow
    AuthenticationMethodOptionsSasl:
      enum:
        - manual
        - secret
      title: Authentication method
      type: string
      description: Enter credentials directly, or select a stored secret
      x-speakeasy-unknown-values: allow
    SaslMechanismOptionsSasl:
      enum:
        - plain
        - scram-sha-256
        - scram-sha-512
        - kerberos
      type: string
      x-speakeasy-enum-descriptions:
        - PLAIN
        - SCRAM-SHA-256
        - SCRAM-SHA-512
        - GSSAPI/Kerberos
      title: SASL mechanism
      x-speakeasy-unknown-values: allow
    SaslExtensionConfInputKafka:
      type: object
      required:
        - name
        - value
      properties:
        name:
          type: string
          title: Field Name
        value:
          type: string
          title: Field Value
    AuthenticationMethodOptionsAuthTokensItems:
      title: Authentication method
      type: string
      enum:
        - manual
        - secret
      description: Select Manual to enter an auth token directly, or select Secret to
        use a text secret to authenticate
      x-speakeasy-unknown-values: allow
    AuthenticationMethodOptions:
      title: Authentication method
      type: string
      enum:
        - manual
        - secret
        - clientSecret
        - clientCert
        - clientAssertion
        - clientAssertion_rpc
      x-speakeasy-unknown-values: allow
    ExtraHttpHeaderConfInputElastic:
      type: object
      required:
        - value
      properties:
        name:
          type: string
          title: Field Name
        value:
          type: string
          title: Field Value
    AuthenticationTypeOptionsPrometheusAuth:
      type: string
      title: Authentication type
      description: Remote Write authentication type
      enum:
        - none
        - basic
        - credentialsSecret
        - token
        - textSecret
      x-speakeasy-enum-descriptions:
        - None
        - Basic
        - Basic (credentials secret)
        - Token
        - Token (text secret)
      x-speakeasy-unknown-values: allow
    AuthenticationTypeOptionsLokiAuth:
      type: string
      title: Authentication type
      description: Loki logs authentication type
      enum:
        - none
        - basic
        - credentialsSecret
        - token
        - textSecret
      x-speakeasy-enum-descriptions:
        - None
        - Basic
        - Basic (credentials secret)
        - Token
        - Token (text secret)
      x-speakeasy-unknown-values: allow
    LogLevelOptions:
      type: string
      title: Log level
      enum:
        - error
        - warn
        - info
        - debug
      description: Collector runtime log level
      x-speakeasy-unknown-values: allow
    RecordTypeOptions:
      enum:
        - SRV
        - A
        - AAAA
      type: string
      title: Record type
      description: DNS record type to resolve
      x-speakeasy-unknown-values: allow
    SearchFilterConfInputPrometheus:
      type: object
      required:
        - Name
        - Values
      properties:
        Name:
          type: string
          title: Filter name
          description: See
            https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html
            for information. Attributes can be manually entered if not present
            in the list.
        Values:
          type: array
          title: Filter values
          description: Values to match within this row's attribute. If empty, search will
            return only running EC2 instances.
          minItems: 0
          items:
            type: string
            minLength: 1
    HttpDiscoveryHeaderConfInputPrometheus:
      type: object
      required:
        - name
        - value
      properties:
        name:
          type: string
          title: Name
        value:
          type: string
          title: Value
    CompressionOptionsPersistence:
      type: string
      title: Compression
      description: Data compression format. Default is gzip.
      enum:
        - none
        - gzip
      x-speakeasy-unknown-values: allow
    ProtocolOptionsTargetsItems:
      type: string
      title: Protocol
      enum:
        - http
        - https
      description: Protocol to use when collecting metrics
      x-speakeasy-unknown-values: allow
    SubscriptionPlanOptions:
      type: string
      title: Subscription plan
      description: Microsoft 365 subscription plan for your organization, typically
        Microsoft 365 Enterprise
      enum:
        - enterprise_gcc
        - gcc
        - gcc_high
        - dod
      x-speakeasy-enum-descriptions:
        - Microsoft 365 Enterprise
        - Microsoft 365 GCC
        - Microsoft 365 GCC High
        - Microsoft 365 DoD
      x-speakeasy-unknown-values: allow
    LogLevelOptionsContentConfigItems:
      type: string
      title: Log Level
      enum:
        - error
        - warn
        - info
        - debug
      description: Collector runtime Log Level
      x-speakeasy-unknown-values: allow
    AuthenticationMethodOptionsManualSecret:
      title: Authentication method
      type: string
      enum:
        - manual
        - secret
      description: Enter client secret directly, or select a stored secret
      x-speakeasy-unknown-values: allow
    LogLevelOptionsDebugError:
      type: string
      title: Log level
      description: Log Level (verbosity) for collection runtime behavior.
      enum:
        - error
        - warn
        - info
        - debug
        - silly
      x-speakeasy-unknown-values: allow
    CertOptionsType:
      type: object
      required:
        - privKeyPath
        - certPath
      properties:
        certificateName:
          type: string
          title: Certificate
          description: The name of the predefined certificate.
        privKeyPath:
          type: string
          title: Private key path
          description: Path to the private key to use. Key should be in PEM format. Can
            reference $ENV_VARS.
        passphrase:
          type: string
          title: Passphrase
          description: Passphrase to use to decrypt the private key.
        certPath:
          type: string
          title: Certificate path
          description: Path to the certificate to use. Certificate should be in PEM
            format. Can reference $ENV_VARS.
    AuthenticationMethodOptionsSaslManualSecret:
      enum:
        - manual
        - secret
      title: Authentication method
      type: string
      description: Enter password directly, or select a stored secret
      x-speakeasy-unknown-values: allow
    SaslMechanismOptionsSaslOauthbearerPlain:
      enum:
        - plain
        - oauthbearer
      type: string
      x-speakeasy-enum-descriptions:
        - PLAIN
        - OAUTHBEARER
      title: SASL mechanism
      x-speakeasy-unknown-values: allow
    AuthenticationMethodOptionsSaslCertificateManual:
      enum:
        - manual
        - secret
        - certificate
      title: Authentication method
      type: string
      x-speakeasy-unknown-values: allow
    MicrosoftEntraIdAuthenticationEndpointOptionsSasl:
      type: string
      title: Microsoft Entra ID authentication endpoint
      enum:
        - https://login.microsoftonline.com
        - https://login.microsoftonline.us
        - https://login.partner.microsoftonline.cn
      description: Endpoint used to acquire authentication tokens from Azure
      x-speakeasy-unknown-values: allow
    TlsSettingsClientSideType:
      type: object
      title: TLS settings (client side)
      required:
        - disabled
      properties:
        disabled:
          type: boolean
          title: Disabled
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: Reject certificates that are not authorized by a CA in the CA
            certificate path, or by another trusted CA (such as the system's)
    AuthenticationMethodOptionsAuth:
      enum:
        - secret
        - certificate
      title: Authentication method
      type: string
      x-speakeasy-unknown-values: allow
    GoogleAuthenticationMethodOptions:
      type: string
      title: Google authentication method
      description: Choose Auto to use Google Application Default Credentials (ADC),
        Manual to enter Google service account credentials directly, or Secret
        to select or create a stored secret that references Google service
        account credentials.
      enum:
        - auto
        - manual
        - secret
      x-speakeasy-enum-descriptions:
        - Auto
        - Manual
        - Secret
      x-speakeasy-unknown-values: allow
    AuthTokenConfInputCriblTcp:
      type: object
      required:
        - tokenSecret
      properties:
        tokenSecret:
          type: string
          title: Token secret (text secret)
          description: Select or create a stored text secret
        enabled:
          type: boolean
          title: Enable token
        description:
          type: string
          title: Description
          description: Optional token description
    ModeOptionsHost:
      type: string
      description: Select level of detail for host metrics
      enum:
        - basic
        - all
        - custom
        - disabled
      x-speakeasy-enum-descriptions:
        - Basic
        - All
        - Custom
        - Disabled
      x-speakeasy-unknown-values: allow
    SetConfInputSystemMetrics:
      type: object
      required:
        - name
        - filter
      properties:
        name:
          type: string
          title: Set Name
        filter:
          type: string
          title: Filter Expression
        includeChildren:
          type: boolean
          title: Include Child Processes
    ModeOptionsGpu:
      type: string
      description: Select the level of detail for GPU metrics
      enum:
        - basic
        - all
        - custom
        - disabled
      x-speakeasy-enum-descriptions:
        - Basic
        - All
        - Custom
        - Disabled
      x-speakeasy-unknown-values: allow
    DataCompressionFormatOptionsPersistence:
      type: string
      title: Data compression format
      enum:
        - none
        - gzip
      x-speakeasy-unknown-values: allow
    RuleConfInputKubeMetrics:
      type: object
      required:
        - filter
      properties:
        filter:
          type: string
          title: Filter Expression
          description: JavaScript expression applied to Kubernetes objects. Return 'true'
            to include it.
        description:
          type: string
          title: Description
          description: Optional description of this rule's purpose
    CheckpointingType:
      type: object
      required:
        - enabled
      properties:
        enabled:
          type: boolean
          title: Enable checkpointing
          description: Resume processing files after an interruption
        retries:
          type: number
          title: Retries
          description: The number of times to retry processing when a processing error
            occurs. If Skip file on error is enabled, this setting is ignored.
          maximum: 100
          minimum: 0
    TagAfterProcessingOptions:
      enum:
        - false
        - true
      x-speakeasy-unknown-values: allow
    LogLevelOptionsContentConfigItemsDebugError:
      type: string
      title: Log level
      enum:
        - error
        - warn
        - info
        - debug
        - silly
      description: Collector runtime log level
      x-speakeasy-unknown-values: allow
    OauthParamConfInputServicenowTable:
      type: object
      required:
        - name
        - value
      properties:
        name:
          type: string
          title: Name
          description: OAuth parameter name
        value:
          type: string
          title: Value
          description: OAuth parameter value
    OauthHeaderConfInputServicenowTable:
      type: object
      required:
        - name
        - value
      properties:
        name:
          type: string
          title: Name
          description: OAuth header name
        value:
          type: string
          title: Value
          description: OAuth header value
    JobTypeOptionsRunnableJobCollection:
      type: string
      title: Job type
      enum:
        - collection
        - executor
        - scheduledSearch
      x-speakeasy-unknown-values: allow
    RunnableJobCollectionTypeCollectionConstraint:
      type: object
      properties:
        type:
          enum:
            - collection
          x-speakeasy-unknown-values: allow
    LogLevelOptionsRunnableJobCollectionScheduleRun:
      type: string
      title: Log level
      description: Level at which to set task logging
      enum:
        - error
        - warn
        - info
        - debug
        - silly
      x-speakeasy-unknown-values: allow
    ExecutorSpecificSettingsTypeRunnableJobExecutorExecutor:
      type: object
      title: Executor-specific settings
      properties: {}
    AdditionalPropertiesTypeJobInfoStats:
      oneOf:
        - type: number
        - type: object
          additionalProperties:
            type: number
    StatusType:
      type: object
      properties:
        error:
          $ref: "#/components/schemas/StatusError"
          description: Error information, if applicable.
        health:
          $ref: "#/components/schemas/HealthStringType"
          description: Overall health status of the Source or Destination.
        metrics:
          type: object
          additionalProperties: true
          description: Metrics data for the Source or Destination.
        pq:
          $ref: "#/components/schemas/WorkerPQStatus"
          description: Persistent queue status information (if persistent queue is enabled).
        timestamp:
          type: number
          description: Timestamp (in Unix time) when the status was last updated.
        useStatusFromLB:
          type: boolean
          description: Set to prefer status from the LB process, not from the worker
            process.
      description: "Runtime status: health, metrics, and optional persistent-queue
        info. Fields may be absent when data is unavailable."
    MethodOptions:
      type: string
      title: Method
      description: The method to use when sending events
      enum:
        - POST
        - PUT
        - PATCH
      x-speakeasy-unknown-values: allow
    FailedRequestLoggingModeOptions:
      type: string
      title: Failed request logging mode
      description: Data to log when a request fails. All headers are redacted by
        default, unless listed as safe headers below.
      enum:
        - payload
        - payloadAndHeaders
        - none
      x-speakeasy-enum-descriptions:
        - Payload
        - Payload + Headers
        - None
      x-speakeasy-unknown-values: allow
    ResponseRetrySettingConfOutputWebhook:
      type: object
      required:
        - httpStatus
      properties:
        httpStatus:
          type: number
          title: HTTP status code
          description: The HTTP response status code that will trigger retries
          minimum: 100
          maximum: 599
        initialBackoff:
          type: number
          title: Pre-backoff interval (ms)
          description: How long, in milliseconds, Cribl Stream should wait before
            initiating backoff. Maximum interval is 600,000 ms (10 minutes).
          minimum: 0
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Base for exponential backoff. A value of 2 (default) means Cribl
            Stream will retry after 2 seconds, then 4 seconds, then 8 seconds,
            etc.
          minimum: 1
          maximum: 20
        maxBackoff:
          type: number
          title: Backoff limit (ms)
          description: The maximum backoff interval, in milliseconds, Cribl Stream should
            apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is
            180,000 ms (180 seconds).
          minimum: 10000
          maximum: 180000
    TimeoutRetrySettingsType:
      type: object
      required:
        - timeoutRetry
      properties:
        timeoutRetry:
          type: boolean
          title: Retry timed-out HTTP requests
        initialBackoff:
          type: number
          title: Pre-backoff interval (ms)
          description: How long, in milliseconds, Cribl Stream should wait before
            initiating backoff. Maximum interval is 600,000 ms (10 minutes).
          minimum: 0
          maximum: 600000
        backoffRate:
          type: number
          title: Backoff multiplier
          description: Base for exponential backoff. A value of 2 (default) means Cribl
            Stream will retry after 2 seconds, then 4 seconds, then 8 seconds,
            etc.
          minimum: 1
          maximum: 20
        maxBackoff:
          type: number
          title: Backoff limit (ms)
          description: The maximum backoff interval, in milliseconds, Cribl Stream should
            apply. Default (and minimum) is 10,000 ms (10 seconds); maximum is
            180,000 ms (180 seconds).
          minimum: 10000
          maximum: 180000
    BackpressureBehaviorOptions:
      type: string
      title: Backpressure behavior
      description: How to handle events when all receivers are exerting backpressure
      enum:
        - block
        - drop
        - queue
      x-speakeasy-enum-descriptions:
        - Block
        - Drop
        - Persistent Queue
      x-speakeasy-unknown-values: allow
    ModeOptions:
      enum:
        - error
        - always
        - backpressure
      title: Mode
      description: In Error mode, PQ writes events to the filesystem if the
        Destination is unavailable. In Backpressure mode, PQ writes events to
        the filesystem when it detects backpressure from the Destination. In
        Always On mode, PQ always writes events to the filesystem.
      type: string
      x-speakeasy-enum-descriptions:
        - Error
        - Backpressure
        - Always On
      x-speakeasy-unknown-values: allow
    QueueFullBehaviorOptions:
      type: string
      enum:
        - block
        - drop
      x-speakeasy-enum-descriptions:
        - Block
        - Drop new data
      title: Queue-full behavior
      description: How to handle events when the queue is exerting backpressure (full
        capacity or low disk). 'Block' is the same behavior as non-PQ blocking.
        'Drop new data' throws away incoming data, while leaving the contents of
        the PQ unchanged.
      x-speakeasy-unknown-values: allow
    TlsOptionsHostsItems:
      type: string
      title: TLS
      description: Whether to inherit TLS configs from group setting or disable TLS
      enum:
        - inherit
        - off
      x-speakeasy-unknown-values: allow
    NestedFieldSerializationOptions:
      type: string
      enum:
        - json
        - none
      x-speakeasy-enum-descriptions:
        - JSON
        - None
      title: Nested field serialization
      description: How to serialize nested fields into index-time fields
      x-speakeasy-unknown-values: allow
    MaxS2SVersionOptions:
      type: string
      title: Max S2S version
      description: The highest S2S protocol version to advertise during handshake
      enum:
        - v3
        - v4
      x-speakeasy-unknown-values: allow
    CompressionOptions:
      type: string
      title: Compression
      description: Controls whether the sender should send compressed data to the
        server. Select 'Disabled' to reject compressed connections or 'Always'
        to ignore server's configuration and send compressed data.
      enum:
        - disabled
        - auto
        - always
      x-speakeasy-enum-descriptions:
        - Disabled
        - Automatic
        - Always
      x-speakeasy-unknown-values: allow
    CompressionOptionsGzipNone:
      type: string
      enum:
        - none
        - gzip
      title: Compression
      description: Codec to use to compress the data before sending
      x-speakeasy-enum-descriptions:
        - None
        - Gzip
      x-speakeasy-unknown-values: allow
    DataFormatOptions:
      type: string
      title: Data format
      description: Format of the output data
      enum:
        - json
        - raw
        - parquet
      x-speakeasy-enum-descriptions:
        - JSON
        - Raw
        - Parquet
      x-speakeasy-unknown-values: allow
    BackpressureBehaviorOptionsBlockDrop:
      type: string
      title: Backpressure behavior
      description: How to handle events when all receivers are exerting backpressure
      enum:
        - block
        - drop
      x-speakeasy-enum-descriptions:
        - Block
        - Drop
      x-speakeasy-unknown-values: allow
    DiskSpaceProtectionOptions:
      type: string
      title: Disk space protection
      description: How to handle events when disk space is below the global 'Min free
        disk space' limit
      enum:
        - block
        - drop
      x-speakeasy-enum-descriptions:
        - Block
        - Drop
      x-speakeasy-unknown-values: allow
    RetrySettingsType:
      type: object
      properties:
        enabled:
          type: boolean
          title: Enable retry backoff
          description: Apply exponential backoff with jitter when file uploads fail
            repeatedly.
        initialBackoffMs:
          type: number
          title: Initial backoff (ms)
          description: "Initial delay before first retry attempt. Valid range: 1s-5min
            (1000-300000ms). Values outside this range will be clamped to the
            nearest valid value."
        backoffMultiplier:
          type: number
          title: Backoff multiplier
          description: "Multiplier applied to backoff delay after each retry. Valid range:
            1-10. Values outside this range will be clamped to the nearest valid
            value."
        maxBackoffMs:
          type: number
          title: Max backoff (ms)
          description: "Maximum delay between retry attempts. Valid range: 1s-10min
            (1000-600000ms). Values outside this range will be clamped to the
            nearest valid value."
        jitterPercent:
          type: number
          title: Jitter (%)
          description: "Random jitter percentage added to backoff delay to prevent
            thundering herd. Valid range: 0-100. Values outside this range will
            be clamped to the nearest valid value."
    OrphanFileRecoveryType:
      type: object
      title: Orphan file recovery
      properties:
        disabled:
          type: boolean
          title: Disabled
          description: Periodically scan the staging directory for files not tracked by
            any Worker manifest to recover them
        periodMin:
          type: number
          title: Period (minutes)
          description: Minimum interval between reconciliation runs
          minimum: 5
          maximum: 1440
    CompressionOptionsHttp:
      type: string
      title: Compression
      description: Data compression format to apply to HTTP content before it is delivered
      enum:
        - none
        - gzip
      x-speakeasy-unknown-values: allow
    CompressionLevelOptions:
      type: string
      title: Compression level
      description: Compression level to apply before moving files to final destination
      enum:
        - best_speed
        - normal
        - best_compression
      x-speakeasy-enum-descriptions:
        - Best Speed
        - Normal
        - Best Compression
      x-speakeasy-unknown-values: allow
    ParquetVersionOptions:
      type: string
      title: Parquet version
      enum:
        - PARQUET_1_0
        - PARQUET_2_4
        - PARQUET_2_6
      x-speakeasy-enum-descriptions:
        - "1.0"
        - "2.4"
        - "2.6"
      description: Determines which data types are supported and how they are represented
      x-speakeasy-unknown-values: allow
    DataPageVersionOptions:
      type: string
      title: Data page version
      enum:
        - DATA_PAGE_V1
        - DATA_PAGE_V2
      x-speakeasy-enum-descriptions:
        - V1
        - V2
      description: Serialization format of data pages. Note that some reader
        implementations use Data page V2's attributes to work more efficiently,
        while others ignore it.
      x-speakeasy-unknown-values: allow
    KeyValueMetadataConfOutputFilesystem:
      type: object
      required:
        - key
        - value
      properties:
        key:
          type: string
          title: Key
        value:
          type: string
          title: Value
    ObjectAclOptions:
      type: string
      title: Object ACL
      description: Object ACL to assign to uploaded objects
      enum:
        - private
        - public-read
        - public-read-write
        - authenticated-read
        - aws-exec-read
        - bucket-owner-read
        - bucket-owner-full-control
      x-speakeasy-enum-descriptions:
        - Private
        - Public Read Only
        - Public Read/Write
        - Authenticated Read Only
        - AWS EC2 AMI Read Only
        - Bucket Owner Read Only
        - Bucket Owner Full Control
      x-speakeasy-unknown-values: allow
    StorageClassOptions:
      type: string
      title: Storage class
      description: Storage class to select for uploaded objects
      enum:
        - STANDARD
        - REDUCED_REDUNDANCY
        - STANDARD_IA
        - ONEZONE_IA
        - INTELLIGENT_TIERING
        - GLACIER
        - GLACIER_IR
        - DEEP_ARCHIVE
      x-speakeasy-enum-descriptions:
        - Standard
        - Reduced Redundancy Storage
        - Standard, Infrequent Access
        - One Zone, Infrequent Access
        - Intelligent Tiering
        - Glacier Flexible Retrieval
        - Glacier Instant Retrieval
        - Glacier Deep Archive
      x-speakeasy-unknown-values: allow
    ServerSideEncryptionForUploadedObjectsOptions:
      type: string
      title: Server-side encryption for uploaded objects
      description: Server-side encryption to use for uploaded objects
      enum:
        - AES256
        - aws:kms
      x-speakeasy-enum-descriptions:
        - Amazon S3 Managed Key
        - AWS KMS Managed Key
      x-speakeasy-unknown-values: allow
    AuthenticationMethodOptionsApi:
      title: Authentication method
      type: string
      enum:
        - manual
        - secret
      description: Enter API key directly, or select a stored secret
      x-speakeasy-unknown-values: allow
    AcknowledgmentsOptions:
      type: integer
      title: Acknowledgments
      description: Control the number of required acknowledgments
      enum:
        - 1
        - 0
        - -1
      x-speakeasy-enum-descriptions:
        - Leader
        - None
        - All
      x-speakeasy-unknown-values: allow
      x-speakeasy-enums:
        - Leader
        - None
        - All
    RecordDataFormatOptions:
      type: string
      enum:
        - json
        - raw
      title: Record data format
      description: Format to use to serialize events before writing to the Event Hubs
        Kafka brokers
      x-speakeasy-enum-descriptions:
        - JSON
        - Field _raw
      x-speakeasy-unknown-values: allow
    ObjectAclOptionsAuthenticatedreadBucketownerfullcontrol:
      type: string
      title: Object ACL
      description: Object ACL to assign to uploaded objects
      enum:
        - private
        - bucket-owner-read
        - bucket-owner-full-control
        - project-private
        - authenticated-read
        - public-read
      x-speakeasy-enum-descriptions:
        - private
        - bucket-owner-read
        - bucket-owner-full-control
        - project-private
        - authenticated-read
        - public-read
      x-speakeasy-unknown-values: allow
    StorageClassOptionsArchiveColdline:
      type: string
      title: Storage class
      description: Storage class to select for uploaded objects
      enum:
        - STANDARD
        - NEARLINE
        - COLDLINE
        - ARCHIVE
      x-speakeasy-enum-descriptions:
        - Standard Storage
        - Nearline Storage
        - Coldline Storage
        - Archive Storage
      x-speakeasy-unknown-values: allow
    LogLabelConfOutputGoogleCloudLogging:
      type: object
      required:
        - label
        - valueExpression
      properties:
        label:
          type: string
          title: Label
          description: Label name
        valueExpression:
          type: string
          title: Value
          description: JavaScript expression to compute the label's value.
    AcknowledgmentsOptionsAllLeader:
      type: integer
      title: Acknowledgments
      description: Control the number of required acknowledgments.
      enum:
        - 1
        - 0
        - -1
      x-speakeasy-enum-descriptions:
        - Leader
        - None
        - All
      x-speakeasy-unknown-values: allow
      x-speakeasy-enums:
        - Leader
        - None
        - All
    RecordDataFormatOptionsJsonProtobuf:
      type: string
      enum:
        - json
        - raw
        - protobuf
      title: Record data format
      description: Format to use to serialize events before writing to Kafka.
      x-speakeasy-enum-descriptions:
        - JSON
        - Field _raw
        - Protobuf
      x-speakeasy-unknown-values: allow
    CompressionOptionsGzipLz4:
      type: string
      enum:
        - none
        - gzip
        - snappy
        - lz4
        - zstd
      title: Compression
      description: Codec to use to compress the data before sending to Kafka
      x-speakeasy-enum-descriptions:
        - None
        - Gzip
        - Snappy
        - LZ4
        - ZSTD
      x-speakeasy-unknown-values: allow
    AuthenticationMethodOptionsAuthManualManualApiKey:
      enum:
        - manual
        - secret
        - manualAPIKey
        - textSecret
      title: Authentication method
      type: string
      description: Enter credentials directly, or select a stored secret
      x-speakeasy-unknown-values: allow
    RegionOptions:
      type: string
      title: Region
      description: Which New Relic region endpoint to use.
      enum:
        - US
        - EU
        - Custom
      x-speakeasy-enum-descriptions:
        - US
        - Europe
        - Custom
      x-speakeasy-unknown-values: allow
    StorageClassOptionsReducedredundancyStandard:
      type: string
      title: Storage class
      description: Storage class to select for uploaded objects
      enum:
        - STANDARD
        - REDUCED_REDUNDANCY
      x-speakeasy-enum-descriptions:
        - Standard
        - Reduced Redundancy Storage
      x-speakeasy-unknown-values: allow
    ServerSideEncryptionForUploadedObjectsOptionsAes256:
      type: string
      title: Server-side encryption for uploaded objects
      description: Server-side encryption to use for uploaded objects
      enum:
        - AES256
      x-speakeasy-enum-descriptions:
        - Amazon S3 Managed Key
      x-speakeasy-unknown-values: allow
    DestinationProtocolOptions:
      type: string
      enum:
        - udp
        - tcp
      title: Destination protocol
      description: Protocol to use when communicating with the destination.
      x-speakeasy-enum-descriptions:
        - UDP
        - TCP
      x-speakeasy-unknown-values: allow
    MessageFormatOptions:
      type: string
      title: Message format
      description: Format to use when sending logs to Loki (Protobuf or JSON)
      enum:
        - protobuf
        - json
      x-speakeasy-enum-descriptions:
        - Protobuf
        - JSON
      x-speakeasy-unknown-values: allow
    AuthenticationTypeOptionsPrometheusAuthBasicCredentialsSecret:
      type: string
      title: Authentication type
      enum:
        - none
        - token
        - textSecret
        - basic
        - credentialsSecret
      x-speakeasy-enum-descriptions:
        - None
        - Auth token
        - Auth token (text secret)
        - Basic
        - Basic (credentials secret)
      x-speakeasy-unknown-values: allow
    ProtocolOptions:
      type: string
      title: Protocol
      description: Select a transport option for OpenTelemetry
      enum:
        - grpc
        - http
      x-speakeasy-enum-descriptions:
        - gRPC
        - HTTP
      x-speakeasy-unknown-values: allow
    CompressionOptionsDeflateGzip:
      type: string
      title: Compression
      description: Type of compression to apply to messages sent to the OpenTelemetry
        endpoint
      enum:
        - none
        - deflate
        - gzip
      x-speakeasy-enum-descriptions:
        - None
        - Deflate
        - Gzip
      x-speakeasy-unknown-values: allow
    CompressionOptionsMessages:
      type: string
      title: Compression
      description: Type of compression to apply to messages sent to the OpenTelemetry
        endpoint
      enum:
        - none
        - gzip
      x-speakeasy-enum-descriptions:
        - None
        - Gzip
      x-speakeasy-unknown-values: allow
    OtlpVersionOptions131:
      type: string
      title: OTLP version
      description: The version of OTLP Protobuf definitions to use when structuring
        data to send
      enum:
        - 1.3.1
      x-speakeasy-enum-descriptions:
        - 1.3.1
      x-speakeasy-unknown-values: allow
    AuthTokenConfOutputCriblHttp:
      type: object
      required:
        - tokenSecret
      properties:
        tokenSecret:
          type: string
          title: Token secret (text secret)
          description: Select or create a stored text secret
        enabled:
          type: boolean
          title: Enable token
        description:
          type: string
          title: Description
    UrlConfOutputCriblHttp:
      type: object
      required:
        - url
      properties:
        url:
          type: string
          title: Cribl Endpoint
          description: URL of a Cribl Worker to send events to, such as
            http://localhost:10200
          pattern: ^https?://.*
        weight:
          type: number
          title: Load Weight
          description: Assign a weight (>0) to each endpoint to indicate its
            traffic-handling capability
          minimum: 0
        __template_url:
          type: string
          description: Binds 'url' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'url' at runtime.
    RequestFormatOptions:
      title: Request format
      type: string
      enum:
        - JSON
        - raw
      x-speakeasy-enum-descriptions:
        - JSON
        - Raw
      description: When set to JSON, the event is automatically formatted with
        required fields before sending. When set to Raw, only the event's `_raw`
        value is sent.
      x-speakeasy-unknown-values: allow
    AuthenticationTypeOptions:
      type: string
      title: Authentication type
      description: ""
      enum:
        - none
        - basic
        - credentialsSecret
        - sslUserCertificate
      x-speakeasy-enum-descriptions:
        - None
        - Basic
        - Basic (credentials secret)
        - SSL User Certificate
      x-speakeasy-unknown-values: allow
    AuthenticationMethodOptionsSecret:
      type: string
      title: Authentication method
      description: Authentication method.
      enum:
        - secret
      x-speakeasy-enum-descriptions:
        - Secret
      x-speakeasy-unknown-values: allow
    AdditionalPropertiesTypeRoutesGroups:
      type: object
      properties:
        description:
          type: string
          description: Brief description of the Route Group.
        index:
          type: integer
          description: Relative position of the Route Group among all Route Groups. Routes
            are evaluated in ascending order according to the index value of
            their Route Group.
        name:
          type: string
          description: Name of the Route Group.
      required:
        - index
        - name
    RouteConfInput:
      type: object
      properties:
        clones:
          type: array
          items:
            $ref: "#/components/schemas/RouteCloneConf"
          description: Array of clone configurations, each with a key-value pair to set or
            overwrite in cloned events. Original events continue to the next
            Route.
        context:
          type: string
          description: "Context for the Route: <code>group</code> (Worker Group or Edge
            Fleet) or <code>pack</code>."
        description:
          type: string
          description: Brief description of the Route.
        disabled:
          type: boolean
          description: If <code>true</code>, disable the Route. Otherwise,
            <code>false</code>.
        enableOutputExpression:
          type: boolean
          description: If <code>true</code>, use the <code>outputExpression</code> for
            dynamic Destination selection. Otherwise, <code>false</code>.
        filter:
          type: string
          description: JavaScript expression to select events for routing.
        groupId:
          type: string
          description: Unique identifier for the Route Group that the Route is associated
            with.
        name:
          type: string
          description: Name of the Route.
        output:
          type: string
          description: Destination that the Route sends matching events to after the
            Pipeline processes the events.
        outputExpression:
          type: string
          description: JavaScript expression to evaluate for dynamic Destination
            selection. Evaluation occurs when the Route is constructed, not for
            each event.
        pipeline:
          type: string
          description: Pipeline that the Route sends matching events to.
        targetContext:
          $ref: "#/components/schemas/TargetContext"
          description: "Target context for subsequent event processing after applying the
            Route: <code>group</code> (Worker Group or Edge Fleet) or
            <code>pack</code>."
        final:
          type: boolean
          description: If <code>true</code> (default), the Route processes matched events
            and sends them to the specified Pipeline. Matched events do not
            continue to the next Route, but non-matched events do continue to
            the next Route. If <code>false</code>, the Route processes matched
            events and sends them to the specified Pipeline, and all events
            (matched and non-matched) continue to the next Route. Must be
            <code>false</code> to clone events.
        id:
          type: string
          description: Unique identifier for the Route. If omitted, the server generates a
            deterministic identifier.
      required:
        - name
        - pipeline
    SecretTypeOptionsRestSecret:
      type: string
      enum:
        - credentials
        - keypair
        - text
      description: Type of the secret. Use <code>text</code> for an arbitrary value,
        <code>keypair</code> for an API key and secret key, or
        <code>credentials</code> for a username and password.
      x-speakeasy-unknown-values: allow
    TlsTypeOutpostConfigsListener:
      type: object
      properties:
        caPath:
          type: string
        certPath:
          type: string
        certificateName:
          type: string
        commonNameRegex:
          type: object
          additionalProperties: true
        disabled:
          type: boolean
        maxVersion:
          $ref: "#/components/schemas/SecureVersion"
        minVersion:
          $ref: "#/components/schemas/SecureVersion"
        passphrase:
          type: string
        privKeyPath:
          type: string
        rejectUnauthorized:
          type: boolean
        requestCert:
          type: boolean
        servername:
          type: string
      required:
        - disabled
    CriblTypeAppscopeConfig:
      type: object
      properties:
        authtoken:
          type: string
        enable:
          type: boolean
        transport:
          $ref: "#/components/schemas/AppscopeTransport"
        useScopeSourceTransport:
          type: boolean
    FormatTypeAppscopeConfigEvent:
      type: object
      properties:
        enhancefs:
          type: boolean
        maxeventpersec:
          type: number
      required:
        - enhancefs
        - maxeventpersec
    WatchConfAppscopeConfig:
      type: object
      properties:
        allowbinary:
          type: boolean
        enabled:
          type: boolean
        field:
          type: string
        headers:
          type: string
        name:
          type: string
        type:
          type: string
        value:
          type: string
      required:
        - type
    LevelOptionsAppscopeConfigLibscopeLog:
      type: string
      enum:
        - error
        - info
        - warning
        - none
        - debug
      x-speakeasy-unknown-values: allow
    FormatTypeAppscopeConfigMetric:
      type: object
      properties:
        statsdmaxlen:
          type: number
        statsdprefix:
          type: string
        type:
          type: string
        verbosity:
          type: number
    PayloadTypeAppscopeConfig:
      type: object
      properties:
        dir:
          type: string
        enable:
          type: boolean
      required:
        - dir
        - enable
    ProtocolConfAppscopeConfig:
      type: object
      properties:
        binary:
          type: boolean
        detect:
          type: boolean
        len:
          type: number
        name:
          type: string
        payload:
          type: boolean
        regex:
          type: string
      required:
        - binary
        - detect
        - len
        - name
        - payload
        - regex
    TagConfAppscopeConfig:
      type: object
      properties:
        key:
          type: string
        value:
          type: string
      required:
        - key
        - value
    ApplyModeOptionsChartElementConfig:
      type: string
      enum:
        - auto
        - manual
      description: "Override the Dashboard-level auto-apply behavior for the
        element.<br/><br/> <code>auto</code>: Auto-apply.<br/>
        <code>manual</code>: Require the Apply button."
      x-speakeasy-unknown-values: allow
    AxisTypeChartElementConfig:
      type: object
      properties:
        xAxis:
          type: string
          description: Field name for the X-axis.
        yAxis:
          type: array
          items:
            type: string
          description: Field names for the Y-axis.
        yAxisExcluded:
          type: array
          items:
            type: string
          description: Field names excluded from the Y-axis.
      description: Axis field mappings for X and Y axes.
    ThresholdConfChartElementConfig:
      type: object
      properties:
        color:
          type: string
          description: CSS color applied when the value meets or exceeds the
            <code>threshold</code>.
          example: "#FF0000"
        threshold:
          type: number
          description: Numeric threshold value.
      required:
        - color
        - threshold
    CustomDataTypeChartElementConfig:
      type: object
      properties:
        connectNulls:
          type: string
          description: Strategy for connecting null data points.
          example: Leave gaps
        dataFields:
          type: array
          items:
            type: string
          description: Specific data fields to include.
        isPointColor:
          type: boolean
          description: If <code>true</code>, apply color encoding to data points.
        limitToTopN:
          type: integer
          description: Limit the display to the top N series by value.
        lines:
          type: boolean
          description: If <code>true</code>, render connecting lines between data points.
        nameField:
          type: string
          description: Field name used for data point labels.
        pointColorPalette:
          type: integer
          description: Index of the color palette used for point coloring.
        pointColorPaletteReversed:
          type: boolean
          description: If <code>true</code>, reverse the point color palette order.
        pointScale:
          type:
            - string
            - number
          description: Scale factor for scatter plot points.
        pointScaleDataField:
          type: string
          description: Field name whose values determine point size.
        seriesCount:
          type: integer
          description: Maximum number of series to display.
        splitBy:
          type: string
          description: Field name to split series by.
        stack:
          type: boolean
          description: If <code>true</code>, stack series on top of each other.
        summarizeOthers:
          type: boolean
          description: If <code>true</code>, aggregate remaining series into an 'Others'
            bucket.
        trellis:
          type: boolean
          description: If <code>true</code>, render each series in its own small-multiples
            panel.
      description: Custom data transformation and display options.
    LegendTypeChartElementConfig:
      type: object
      properties:
        position:
          type: string
          description: Legend position.
          example: Right
        selected:
          type: object
          additionalProperties:
            type: boolean
          description: Map of series names to their visibility state in the legend.
        truncate:
          type: boolean
          description: If <code>true</code>, truncate long legend labels.
      description: Legend display settings.
    MapDetailsTypeChartElementConfig:
      type: object
      properties:
        latitudeField:
          type: string
          description: Field name for latitude values.
        longitudeField:
          type: string
          description: Field name for longitude values.
        mapSourceID:
          type: string
          description: Identifier of the map source.
          example: World
        mapType:
          type: string
          description: Map projection type.
        nameField:
          type: string
          description: Field name for region names on the map.
        pointScale:
          type:
            - string
            - number
          description: Scale factor for map data points.
        valueField:
          type: string
          description: Field name for the data value driving map coloring or sizing.
      description: Geo-map chart configuration.
    FormatTypeChartElementConfigXAxis:
      oneOf:
        - type: string
        - $ref: "#/components/schemas/ChartAxisFormat"
      description: Numeric format for axis labels.
    AutoApplyModeOptionsSearchDashboard:
      type: string
      enum:
        - all
        - metric
        - off
      description: "Auto-apply behavior for Input changes to Dashboard
        panels.<br/><br/> <code>off</code>: Panels do not auto-refresh. Users
        must manually apply changes with the Apply button.<br/>
        <code>metric</code>: Only metric and saved search panels auto-refresh.
        For other panels, users must manually apply changes with the Apply
        button.<br/> <code>all</code>: All panels auto-refresh."
      x-speakeasy-unknown-values: allow
    AutoApplyUrlSyncOptionsSearchDashboard:
      type: string
      enum:
        - off
        - push
        - replace
      description: "Browser URL synchronization behavior for Input changes.<br/><br/>
        <code>off</code>: Input changes do not sync to the URL.<br/>
        <code>replace</code>: Input changes update the URL using replaceState.
        The URL changes but no new browser history entry is created. The back
        button in the browser does not step through previous Input states.<br/>
        <code>push</code>: Each Input change updates the URL using pushState and
        creates a new browser history entry. The back button in the browser
        steps through previous Input states."
      x-speakeasy-unknown-values: allow
    TemplateVisualizationSectionDisplayConfigType:
      type: object
      properties:
        collapsed:
          type: boolean
          description: If <code>true</code>, the section is collapsed by default in the
            Notebook.
    VariantOptionsTemplateVisualizationSection:
      type: string
      enum:
        - chart
        - events
        - visualization
      description: "Broad type of the element that determines the editor or renderer
        to use.<br/><br/> <code>visualization</code>: Visual panels like charts,
        counters, tables, and events.<br/> <code>input</code>: Input elements
        like dropdown menus, time pickers, text, and numbers.<br/>
        <code>markdown</code>: Markdown elements."
      x-speakeasy-unknown-values: allow
    CacheStatusByDatasetIdUsedCacheTrueWithComputeTypeConstraint:
      type: object
      properties:
        computeType:
          $ref: "#/components/schemas/SearchComputeType"
          description: Compute tier that was associated with the cached resolution.
        usedCache:
          type: boolean
          const: true
          description: If <code>true</code>, the results were served from cache.
      required:
        - computeType
        - usedCache
    CacheStatusOptionsCacheStatusByDatasetIdAdditionalProperties:
      type: string
      enum:
        - error
        - miss
      description: Indicates whether the cache miss was a normal miss or an error.
      x-speakeasy-unknown-values: allow
    PendingComputeNodeStatusesTypeSearchJob:
      type: object
      properties:
        countCold:
          type: integer
          description: Identifies pending Nodes already allocated the cold provisioning
            path.
        countWarm:
          type: integer
          description: Identifies pending Nodes already allocated to the warm pool path.
      required:
        - countCold
        - countWarm
    StatusOptionsSearchJob:
      type: string
      enum:
        - canceled
        - completed
        - failed
        - new
        - queued
        - running
      description: Lifecycle state of the job (queued, running, completed, failed,
        canceled, and so on).
      x-speakeasy-unknown-values: allow
    EstimatedIngestRateOptionsConfigGroup:
      type: integer
      enum:
        - 1024
        - 2048
        - 3072
        - 4096
        - 5120
        - 7168
        - 10240
        - 13312
        - 15360
      description: Estimated ingest rate for a Cribl.Cloud Worker Group, in GB/sec.
      x-speakeasy-enum-descriptions:
        - 12 MB/sec
        - 24 MB/sec
        - 36 MB/sec
        - 48 MB/sec
        - 60 MB/sec
        - 84 MB/sec
        - 120 MB/sec
        - 156 MB/sec
        - 180 MB/sec
      x-speakeasy-enums:
        - Rate12MBPerSec
        - Rate24MBPerSec
        - Rate36MBPerSec
        - Rate48MBPerSec
        - Rate60MBPerSec
        - Rate84MBPerSec
        - Rate120MBPerSec
        - Rate156MBPerSec
        - Rate180MBPerSec
      x-speakeasy-unknown-values: allow
      example: 4096
    TypeOptionsConfigGroup:
      type: string
      enum:
        - edge
        - lake_access
        - local_search
        - outpost
        - search
        - stream
      description: Explicit type of the Worker Group, Outpost Group, or Edge Fleet.
      x-speakeasy-unknown-values: allow
    DistModeOptionsProvisioningTokenWithSecret:
      type: string
      enum:
        - single
        - master
        - worker
        - edge
        - managed-edge
        - outpost
        - search-supervisor
      x-speakeasy-unknown-values: allow
    AdditionalPropertiesTypeUserWorkspaceRoles:
      type: object
      properties:
        roles:
          type: array
          items:
            type: string
        workspaceId:
          type: string
      required:
        - roles
        - workspaceId
    FormatOptionsCriblLakeDataset:
      type: string
      enum:
        - ddss
        - json
        - netskope
        - parquet
      description: Storage format used for data persisted in the Dataset.
      x-speakeasy-unknown-values: allow
    StorageClassOptionsCriblLakeDataset:
      type: string
      enum:
        - DEEP_ARCHIVE
        - GLACIER
        - GLACIER_IR
        - INTELLIGENT_TIERING
        - ONEZONE_IA
        - STANDARD
        - STANDARD_IA
      description: Storage class used for objects written to the Dataset.
      x-speakeasy-unknown-values: allow
    StatusOptionsCriblLakeStorageLocation:
      type: string
      description: Provisioning lifecycle status of the Storage Location.
      readOnly: true
      enum:
        - provisioning
        - ready
        - terminated
        - failed
        - delayed
        - blocked
      x-speakeasy-unknown-values: allow
    ProviderOptionsCriblLakeStorageLocation:
      type: string
      description: Cloud storage provider type.
      readOnly: true
      enum:
        - aws-s3
        - azure_blob
        - netskope
      x-speakeasy-unknown-values: allow
    EncryptionOptionsCriblLakeStorageLocationConfig:
      type: string
      enum:
        - SSE-S3
        - SSE-KMS
      description: S3 encryption type (for aws-s3 provider)
      x-speakeasy-unknown-values: allow
    TypeOptionsCriblLakeStorageLocationConfigInventoryConfig:
      type: string
      description: Inventory type.
      enum:
        - s3-inventory
        - azure-inventory
      x-speakeasy-unknown-values: allow
    MethodOptionsCriblLakeStorageLocationCredentials:
      description: Credential resolution method
      enum:
        - auto
        - manual
      x-speakeasy-unknown-values: allow
    WriterCredentialsTypeCriblLakeStorageLocation:
      type: object
      description: Credentials for the IAM role granted to an external party for writing.
      properties:
        trustedPrincipal:
          type: string
          description: The AWS principal ARN trusted to assume the writer role.
        roleToAssume:
          type: string
          description: ARN of the IAM role granted to the external party for writing.
        roleToAssumeExternalId:
          type: string
          description: External ID required when assuming the writer role.
    TimestampFieldContentsOptionsDatasetApiAzureDataExplorer:
      type: string
      enum:
        - kusto_datetime
        - epoch_sec
        - epoch_millis
        - iso_string
      x-speakeasy-unknown-values: allow
    ScalarOrArray:
      oneOf:
        - type: string
        - type: array
          items:
            type: string
    HeadersTypeAppProxyConfigEntity:
      type: object
      properties:
        allowlist:
          type: array
          items:
            type: string
          description: Glob patterns that App-set request headers must match to be
            forwarded to the external service. Supports <code>*</code>
            wildcards. If omitted, all non-sensitive request headers are
            forwarded.
        blocklist:
          type: array
          items:
            type: string
          description: Glob patterns that determine which App-set request headers to strip
            before forwarding to the external service. Supports <code>*</code>
            wildcards. Takes precedence over the <code>allowlist</code> (if a
            request header matches a pattern in <code>allowlist</code> and
            <code>blocklist</code>, the header is stripped).
        inject:
          type: object
          additionalProperties:
            type: string
          description: Headers injected server-side on proxied requests. Values support
            <code>C.kv.&lt;key&gt;</code> and <code>C.env.&lt;name&gt;</code>
            expressions.
      description: Header rules for outgoing requests to the domain.
    PathsTypeAppProxyConfigEntity:
      type: object
      properties:
        allowlist:
          type: array
          items:
            type: string
          description: Path prefixes allowed on the domain. If omitted, all paths are
            allowed.
        blocklist:
          type: array
          items:
            type: string
          description: Path prefixes blocked on the domain. Takes precedence over the
            <code>allowlist</code>.
      description: Path filtering rules for the domain.
    AwsTypeHeartbeatMetadata:
      type: object
      properties:
        enabled:
          type: boolean
        instanceId:
          type: string
        region:
          type: string
        tags:
          type: object
          additionalProperties:
            type: string
        type:
          type: string
        zone:
          type: string
      required:
        - enabled
        - instanceId
        - region
        - type
        - zone
    AzureTypeHeartbeatMetadata:
      type: object
      properties:
        enabled:
          type: boolean
        hostname:
          type: string
        instanceId:
          type: string
        name:
          type: string
        region:
          type: string
        resourceGroup:
          type: string
        subscriptionId:
          type: string
        tags:
          type: object
          additionalProperties:
            type: string
        type:
          type: string
        vmId:
          type: string
        zone:
          type: string
      required:
        - enabled
    HostOsTypeHeartbeatMetadata:
      type: object
      properties:
        addresses:
          type: array
          items:
            type: string
        enabled:
          type: boolean
        id:
          type: string
        version:
          type: string
      required:
        - addresses
        - enabled
        - id
        - version
    OwnerTypeHeartbeatMetadataKube:
      type: object
      properties:
        kind:
          type: string
        name:
          type: string
      required:
        - kind
        - name
    PackageUrlConfDistributedUpgradeRequest:
      type: object
      required:
        - packageUrl
      properties:
        packageUrl:
          type: string
          title: Platform-Specific Package Location
          description: Package HTTP URL or local path
          pattern: (\d+)\.(\d+)\.?(\d+)?-?([-.a-zA-Z0-9]*)-([a-z0-9]{8})-(linux|darwin|win32)-([0-9a-zA-Z]+)
          minLength: 1
        packageHashUrl:
          type: string
          title: Package Hash Location
          description: Package's MD5 or SHA256 hash HTTP URL or local path
          pattern: (\d+)\.(\d+)\.?(\d+)?-?([-.a-zA-Z0-9]*)-([a-z0-9]{8})-(linux|darwin|win32)-([0-9a-zA-Z]+)\.(tgz|msi|pkg)?\.(md5|sha256)
          minLength: 1
    TimeSeriesDimensionFilterOperatorEqWithNameConstraint:
      type: object
      properties:
        name:
          type: string
        operator:
          type: string
          const: eq
        value:
          type: string
      required:
        - name
        - operator
        - value
    TagsTypePackInstallInfo:
      type: object
      properties:
        dataType:
          type: array
          items:
            type: string
        domain:
          type: array
          items:
            type: string
        streamtags:
          type: array
          items:
            type: string
        technology:
          type: array
          items:
            type: string
    FilesTypeGitCommitSummary:
      type: object
      properties:
        created:
          type: array
          items:
            type: string
          description: Array of file paths that were created in the commit.
        deleted:
          type: array
          items:
            type: string
          description: Array of file paths that were deleted in the commit.
        modified:
          type: array
          items:
            type: string
          description: Array of file paths that were modified in the commit.
        renamed:
          type: array
          items:
            $ref: "#/components/schemas/GitFileRename"
          description: Array of file rename operations, each containing the original path
            and the new path.
    SslTypeSystemSettingsConfApi:
      type: object
      properties:
        caPath:
          type: string
        certPath:
          type: string
        disabled:
          type: boolean
        passphrase:
          type: string
        privKeyPath:
          type: string
      required:
        - certPath
        - disabled
        - passphrase
        - privKeyPath
    AppsTypeSystemSettingsConf:
      type: object
      properties:
        enabled:
          type: boolean
      required:
        - enabled
    CustomLogoTypeSystemSettingsConf:
      type: object
      properties:
        enabled:
          type: boolean
        logoDescription:
          type: string
        logoImage:
          type: string
      required:
        - enabled
    ProxyTypeSystemSettingsConf:
      type: object
      properties:
        useEnvVars:
          type: boolean
      required:
        - useEnvVars
    ShutdownTypeSystemSettingsConf:
      type: object
      properties:
        drainTimeout:
          type: number
      required:
        - drainTimeout
    SocketsTypeSystemSettingsConf:
      type: object
      properties:
        directory:
          type: string
    FeatureFlagOverrideConfSystemSettingsConf:
      type: object
      properties:
        disabled:
          type: boolean
        flagId:
          type: string
      required:
        - disabled
        - flagId
    UpgradeOptionsSystemSettingsConfSystem:
      enum:
        - false
        - api
      x-speakeasy-unknown-values: allow
    WorkersTypeSystemSettingsConf:
      type: object
      properties:
        count:
          type: number
        enableHeapSnapshots:
          type: boolean
        loadThrottlePerc:
          type: number
        memory:
          type: number
        minimum:
          type: number
        startupMaxConns:
          type: number
        startupThrottleTimeout:
          type: number
        v8SingleThread:
          type: boolean
      required:
        - count
        - memory
        - minimum
    AdditionalPropertiesTypeDsdStoredConnectionDiscoveredAccounts:
      type: object
      properties:
        lastDataScanAt:
          type:
            - "null"
            - number
        ouPath:
          type: string
      required:
        - lastDataScanAt
        - ouPath
    RegionConfDsdDataScanServiceEntry:
      type: string
      enum:
        - us-east-2
        - us-east-1
        - us-west-1
        - us-west-2
        - af-south-1
        - ap-east-1
        - ap-south-2
        - ap-southeast-3
        - ap-southeast-5
        - ap-southeast-4
        - ap-south-1
        - ap-northeast-3
        - ap-northeast-2
        - ap-southeast-1
        - ap-southeast-2
        - ap-southeast-7
        - ap-northeast-1
        - ca-central-1
        - ca-west-1
        - eu-central-1
        - eu-west-1
        - eu-west-2
        - eu-south-1
        - eu-west-3
        - eu-south-2
        - eu-north-1
        - eu-central-2
        - il-central-1
        - me-south-1
        - me-central-1
        - sa-east-1
        - us-gov-east-1
        - us-gov-west-1
      x-speakeasy-unknown-values: allow
    PreviewResponseBodyEventsItemsType:
      type: object
      properties:
        _raw:
          type: object
          additionalProperties: true
          description: Structured event payload or parsed fields; shape depends on dataset
            and pipeline. Often includes the original line or extracted
            key-value pairs.
        _time:
          type: integer
          description: Event timestamp, typically Unix time in milliseconds for ordering
            and time-bucketing.
      required:
        - _raw
        - _time
    FailureInfoTypeExecutorMetric:
      oneOf:
        - type: "null"
        - $ref: "#/components/schemas/ExecutionFailure"
    LocalSearchSourceDocsInlineTypeTextWithTextConstraint:
      type: object
      properties:
        text:
          type: string
        type:
          type: string
          const: text
      required:
        - text
        - type
    LocalSearchSourceDocsInlineTypeBreakConstraint:
      type: object
      properties:
        type:
          type: string
          const: break
      required:
        - type
    LocalSearchSourceDocsInlineTypeEmphasisWithChildrenConstraint:
      type: object
      properties:
        children:
          type: array
          items:
            $ref: "#/components/schemas/LocalSearchSourceDocsInline"
        type:
          type: string
          const: emphasis
      required:
        - children
        - type
    TimestampFormatTypeEventBreakerExistingOrNewNew:
      type: object
      required:
        - type
      title: Timestamp format
      properties:
        type:
          $ref: "#/components/schemas/TimestampTypeOptionsEventBreakerExistingOrNewNewTim\
            estamp"
        length:
          type: number
          title: Length
          minimum: 2
        format:
          type: string
          title: Format
      allOf:
        - $ref: "#/components/schemas/EventBreakerExistingOrNewNewTimestampType"
    TlsOptionsTypeRedisDeploymentTypeStandalone:
      type: object
      properties:
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: Reject certificates that are not authorized by a CA in the 'CA
            certificate path', or by another trusted CA (such as the system's
            CA)
        servername:
          type: string
          title: Server name (SNI)
          description: Server name for the SNI (Server Name Indication) TLS extension.
            Must be a host name, not an IP address.
        certificateName:
          type: string
          title: Certificate
          description: The name of the predefined certificate
        caPath:
          type: string
          title: CA certificate path
          description: Path on client in which to find CA certificates to verify the
            server's certificate. PEM format. Can reference $ENV_VARS.
        privKeyPath:
          type: string
          title: Private key path (mutual auth)
          description: Path on client in which to find the private key to use. PEM format.
            Can reference $ENV_VARS.
        certPath:
          type: string
          title: Certificate path (mutual auth)
          description: Path on client in which to find certificates to use. PEM format.
            Can reference $ENV_VARS.
        passphrase:
          type: string
          title: Passphrase
          description: Passphrase to use to decrypt private key
        minVersion:
          $ref: "#/components/schemas/MinimumTlsVersionOptionsRedisDeploymentTypeStandalo\
            neTlsOptions"
        maxVersion:
          $ref: "#/components/schemas/MaximumTlsVersionOptionsRedisDeploymentTypeStandalo\
            neTlsOptions"
    TlsOptionsTypeRedisDeploymentTypeCluster:
      type: object
      properties:
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: Reject certs that are not authorized by a CA in the CA certificate
            path, or by another trusted CA (such as the system's CA)
        servername:
          type: string
          title: Server name (SNI)
          description: Server name for the SNI (Server Name Indication) TLS extension.
            Must be a host name, not an IP address.
        certificateName:
          type: string
          title: Certificate
          description: The name of the predefined certificate
        caPath:
          type: string
          title: CA certificate path
          description: Path on client in which to find CA certificates to verify the
            server's certificate. PEM format. Can reference $ENV_VARS.
        privKeyPath:
          type: string
          title: Private key path (mutual auth)
          description: Path on client in which to find the private key to use. PEM format.
            Can reference $ENV_VARS.
        certPath:
          type: string
          title: Certificate path (mutual auth)
          description: Path on client in which to find certificates to use. PEM format.
            Can reference $ENV_VARS.
        passphrase:
          type: string
          title: Passphrase
          description: Passphrase to use to decrypt private key
        minVersion:
          $ref: "#/components/schemas/MinimumTlsVersionOptionsRedisDeploymentTypeStandalo\
            neTlsOptions"
        maxVersion:
          $ref: "#/components/schemas/MaximumTlsVersionOptionsRedisDeploymentTypeStandalo\
            neTlsOptions"
    PaginationTypeRestDiscoveryDiscoverTypeHttp:
      type: object
      required:
        - type
      properties:
        type:
          $ref: "#/components/schemas/PaginationOptionsRestDiscoveryDiscoverTypeHttpPagin\
            ation"
        maxPages:
          type: number
          title: Page limit
          description: Maximum number of pages to retrieve for the discover task. Defaults
            to 50 pages. Set to 0 to retrieve all pages.
          minimum: 0
        lastPageExpr:
          type: string
          title: Last-page expression
          description: JavaScript expression used to determine when the last page has been
            reached. The values tested by this expression must be in the
            Response attributes section.
        nextRelationAttribute:
          type: string
          title: Next page relation name
          description: 'Relation name used in the link header that refers to the next page
            in the result set. Example: rel="next" refers to the next page of
            results: <https://myHost/nextPage>; rel="next"'
        curRelationAttribute:
          type: string
          title: Current page relation name
          description: 'Relation name used in the link header that refers to the current
            result set. Example: rel="self" refers to the current page of
            results: <https://myHost/curPage>; rel="self" '
        offsetField:
          type: string
          title: Offset field name
          description: "Query string parameter that sets the index from which to begin
            returning records. Example:
            /api/v1/query?term=cribl&limit=100&offset=0"
        offset:
          type: number
          title: Starting offset
          description: Offset index from which to start request. Defaults to undefined,
            which will start discovery from the first record.
        limitField:
          type: string
          title: Limit field name
          description: "Query string parameter that sets the number of records retrieved
            per request. Example: /api/v1/query?term=cribl&limit=100&offset=0"
        limit:
          type: number
          title: Record limit
          description: Maximum number of records to retrieve per request
          minimum: 1
        totalRecordField:
          type: string
          title: Total record count field name
          description: Name of the attribute in the response that contains the total
            number of records for the query
        zeroIndexed:
          type: boolean
          title: Zero-based index
          description: Enable to indicate that the first page in the requested data is at
            index 0. Disabled by default, which indicates index 1.
        pageField:
          type: string
          title: Page number field name
          description: "Query string parameter that sets the page index to be returned.
            Example: /api/v1/query?term=cribl&page_size=100&page_number=0"
        page:
          type: number
          title: Starting page number
          description: Page number from which to start request. Defaults to undefined,
            which will start discovery from the first page.
        sizeField:
          type: string
          title: Page size field name
          description: "Query string parameter that sets the number of records retrieved
            per request. Example:
            /api/v1/query?term=cribl&page_size=100&page_number=0"
        size:
          type: number
          title: Record limit
          description: Maximum number of records to retrieve per page
          minimum: 1
        totalPageField:
          type: string
          title: Total page count field name
          description: Name of the attribute in the response that contains the total
            number of pages for the query
      allOf:
        - $ref: "#/components/schemas/RestDiscoveryDiscoverTypeHttpPaginationType"
    PqType:
      type: object
      properties:
        mode:
          $ref: "#/components/schemas/ModeOptionsPq"
        maxBufferSizeBytes:
          type: string
          title: Buffer size limit (bytes)
          description: The maximum size to hold in memory before writing events to disk.
            Enter a numeral with units of KB, MB, etc. The minimum value is 64KB
            and the maximum value is 10MB.
          pattern: ^\d+\s*(?:\w{2})?$
        maxBufferSize:
          type: number
          title: Buffer size limit (events - deprecated)
          description: Maximum number of events to hold in memory before writing the
            events to disk. Deprecated and only supported in workers < v4.17.0.
            Use maxBufferSizeBytes instead.
          minimum: 42
        commitFrequency:
          type: number
          title: Commit frequency
          description: The number of events to send downstream before committing that
            Stream has read them
          minimum: 1
        maxFileSize:
          type: string
          title: File size limit
          description: The maximum size to store in each queue file before closing and
            optionally compressing. Enter a numeral with units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        maxSize:
          type: string
          title: Queue size limit
          description: The maximum disk space that the queue can consume (as an average
            per Worker Process) before queueing stops. Enter a numeral with
            units of KB, MB, etc.
          pattern: ^\d+\s*(?:\w{2})?$
        path:
          type: string
          title: Queue file path
          description: "The location for the persistent queue files. To this field's
            value, the system will append: /<worker-id>/inputs/<input-id>"
        compress:
          $ref: "#/components/schemas/CompressionOptionsPq"
        pqControls:
          type: object
          title: ""
    AuthType:
      type: object
      description: Credentials to use when authenticating with the schema registry
      required:
        - disabled
      properties:
        disabled:
          type: boolean
          title: Disabled
        oauthEnabled:
          type: boolean
          title: Enable OAuth
          description: Authenticate with the schema registry using OAuth instead of basic
            HTTP authentication
        tokenUrl:
          type: string
          title: Token URL
          description: URL of the token endpoint to use for OAuth authentication
        clientId:
          type: string
          title: Client ID
          description: Client ID to use for OAuth authentication
        oauthSecretType:
          type: string
        clientTextSecret:
          type: string
          title: Client secret (text secret)
          description: Select or create a stored text secret
        oauthParams:
          type: array
          title: Add OAuth Parameters
          description: Additional fields to send to the token endpoint, such as scope or
            audience
          items:
            $ref: "#/components/schemas/OauthParamConfInputKafka"
        identityPoolId:
          type: string
          title: Identity pool ID
          description: Confluent Cloud identity pool ID. Sent as the
            `Confluent-Identity-Pool-Id` header on requests to the schema
            registry.
        logicalCluster:
          type: string
          title: Logical cluster
          description: Confluent Cloud Schema Registry logical cluster ID. Sent as the
            `target-sr-cluster` header on requests to the schema registry.
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        __template_tokenUrl:
          type: string
          description: Binds 'tokenUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tokenUrl' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
        __template_identityPoolId:
          type: string
          description: Binds 'identityPoolId' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'identityPoolId' at
            runtime.
        __template_logicalCluster:
          type: string
          description: Binds 'logicalCluster' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'logicalCluster' at
            runtime.
    TlsSettingsClientSideTypeCaPathCertPath:
      type: object
      title: TLS settings (client side)
      properties:
        disabled:
          type: boolean
          title: Disabled
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates that are not authorized by a CA in the CA
            certificate path, or by another 
                                trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present.
        servername:
          type: string
          title: Server name (SNI)
          description: Server name for the SNI (Server Name Indication) TLS extension. It
            must be a host name, and not an IP address.
        certificateName:
          type: string
          title: Certificate
          description: The name of the predefined certificate
        caPath:
          type: string
          title: CA certificate path
          description: Path on client in which to find CA certificates to verify the
            server's cert. PEM format. Can reference $ENV_VARS.
        privKeyPath:
          type: string
          title: Private key path (mutual auth)
          description: Path on client in which to find the private key to use. PEM format.
            Can reference $ENV_VARS.
        certPath:
          type: string
          title: Certificate path (mutual auth)
          description: Path on client in which to find certificates to use. PEM format.
            Can reference $ENV_VARS.
        passphrase:
          type: string
          title: Passphrase
          description: Passphrase to use to decrypt private key
        minVersion:
          $ref: "#/components/schemas/MinimumTlsVersionOptionsTls"
        maxVersion:
          $ref: "#/components/schemas/MaximumTlsVersionOptionsTls"
    AuthenticationType:
      type: object
      title: Authentication
      description: Authentication parameters to use when connecting to brokers. Using
        TLS is highly recommended.
      required:
        - disabled
      properties:
        disabled:
          type: boolean
          title: Disabled
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSasl"
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        mechanism:
          $ref: "#/components/schemas/SaslMechanismOptionsSasl"
        keytabLocation:
          type: string
          title: Keytab Location
          description: Location of keytab file for authentication principal
        principal:
          type: string
          title: Principal
          description: Authentication principal, such as `kafka_user@example.com`
        brokerServiceClass:
          type: string
          title: Broker service class
          description: Kerberos service class for Kafka brokers, such as `kafka`
        oauthEnabled:
          type: boolean
          title: Enable OAuth
          description: Enable OAuth authentication
        tokenUrl:
          type: string
          title: Token URL
          description: URL of the token endpoint to use for OAuth authentication
        clientId:
          type: string
          title: Client ID
          description: Client ID to use for OAuth authentication
        oauthSecretType:
          type: string
        clientTextSecret:
          type: string
          title: Client secret (text secret)
          description: Select or create a stored text secret
        oauthParams:
          type: array
          title: Add OAuth Parameters
          description: Additional fields to send to the token endpoint, such as scope or
            audience
          items:
            $ref: "#/components/schemas/OauthParamConfInputKafka"
        saslExtensions:
          type: array
          title: Add SASL Extension Fields
          description: Additional SASL extension fields, such as Confluent's
            logicalCluster or identityPoolId
          items:
            $ref: "#/components/schemas/SaslExtensionConfInputKafka"
        __template_mechanism:
          type: string
          description: Binds 'mechanism' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'mechanism' at runtime.
        __template_keytabLocation:
          type: string
          description: Binds 'keytabLocation' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'keytabLocation' at
            runtime.
        __template_principal:
          type: string
          description: Binds 'principal' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'principal' at runtime.
        __template_brokerServiceClass:
          type: string
          description: Binds 'brokerServiceClass' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'brokerServiceClass' at runtime.
        __template_tokenUrl:
          type: string
          description: Binds 'tokenUrl' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tokenUrl' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
    TlsSettingsServerSideType:
      type: object
      title: TLS settings (server side)
      properties:
        disabled:
          type: boolean
          title: Disabled
        requestCert:
          type: boolean
          title: Authenticate client (mutual auth)
          description: Require clients to present their certificates. Used to perform
            client authentication using SSL certs.
        rejectUnauthorized:
          type: boolean
          title: Validate client certificates
          description: Reject certificates not authorized by a CA in the CA certificate
            path or by another trusted CA (such as the system's)
        commonNameRegex:
          type: string
          title: Common name
          description: Regex matching allowable common names in peer certificates' subject
            attribute
        certificateName:
          type: string
          title: Certificate
          description: The name of the predefined certificate
        privKeyPath:
          type: string
          title: Private key path
          description: Path on server containing the private key to use. PEM format. Can
            reference $ENV_VARS.
        passphrase:
          type: string
          title: Passphrase
          description: Passphrase to use to decrypt private key
        certPath:
          type: string
          title: Certificate path
          description: Path on server containing certificates to use. PEM format. Can
            reference $ENV_VARS.
        caPath:
          type: string
          title: CA certificate path
          description: Path on server containing CA certificates to use. PEM format. Can
            reference $ENV_VARS.
        minVersion:
          $ref: "#/components/schemas/MinimumTlsVersionOptionsTls"
        maxVersion:
          $ref: "#/components/schemas/MaximumTlsVersionOptionsTls"
    AuthTokensExtConfInputHttp:
      type: object
      required:
        - token
      properties:
        token:
          type: string
          title: Token
          description: "Shared secret to be provided by any client (Authorization: <token>)"
        description:
          type: string
          title: Description
        metadata:
          type: array
          title: Fields
          description: Fields to add to events referencing this token
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
    RetryRulesType:
      type: object
      required:
        - type
      properties:
        type:
          $ref: "#/components/schemas/RetryTypeOptionsHealthCheckCollectorConfRetryRules"
        interval:
          type: number
          title: Initial retry interval (ms)
          description: Time interval between failed request and first retry (kickoff).
            Maximum allowed value is 20,000 ms (1/3 minute).
          minimum: 0
          maximum: 20000
        limit:
          type: number
          title: Retry limit
          description: The maximum number of times to retry a failed HTTP request
          minimum: 0
          maximum: 20
        multiplier:
          type: number
          title: Backoff multiplier
          description: Base for exponential backoff, e.g., base 2 means that retries will
            occur after 2, then 4, then 8 seconds, and so on
          minimum: 1
          maximum: 20
        codes:
          type: array
          title: Retry HTTP codes
          description: List of HTTP codes that trigger a retry. Leave empty to use the
            default list of 429 and 503.
          minItems: 1
          items:
            type: number
            minLength: 1
        enableHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) or
            a timestamp after which to retry the request. The delay is limited
            to 20 seconds, even if the Retry-After header specifies a longer
            delay. When disabled, all Retry-After headers are ignored.
        retryConnectTimeout:
          type: boolean
          title: Retry connection timeout
          description: Make a single retry attempt when a connection timeout (ETIMEDOUT)
            error occurs
        retryConnectReset:
          type: boolean
          title: Retry connection reset
          description: Retry request when a connection reset (ECONNRESET) error occurs
    DiskSpoolingType:
      type: object
      title: Disk Spooling
      properties:
        enable:
          type: boolean
          title: Enable disk spooling
          description: Spool events on disk for Cribl Edge and Search. Default is disabled.
        timeWindow:
          type: string
          title: Bucket time span
          description: Time period for grouping spooled events. Default is 10m.
        maxDataSize:
          type: string
          title: Data size limit
          description: "Maximum disk space that can be consumed before older buckets are
            deleted. Examples: 420MB, 4GB. Default is 1GB."
          pattern: ^\d+(\.\d+)?\s*(?:[kmgKMG](b|B))?$
        maxDataTime:
          title: Data age limit
          type: string
          description: "Maximum amount of time to retain data before older buckets are
            deleted. Examples: 2h, 4d. Default is 24h."
          pattern: \d+[smhd]$
        compress:
          $ref: "#/components/schemas/CompressionOptionsPersistence"
    RetryRulesTypeCodesEnableHeader:
      type: object
      required:
        - type
      properties:
        type:
          $ref: "#/components/schemas/RetryTypeOptionsHealthCheckCollectorConfRetryRules"
        interval:
          type: number
          title: Initial retry interval (ms)
          description: Time interval between failed request and first retry (kickoff).
            Maximum allowed value is 20,000 ms (1/3 minute).
          minimum: 0
          maximum: 20000
        limit:
          type: number
          title: Retry limit
          description: The maximum number of times to retry a failed HTTP request
          minimum: 0
          maximum: 20
        multiplier:
          type: number
          title: Backoff multiplier
          description: Base for exponential backoff, e.g., base 2 means that retries will
            occur after 2, then 4, then 8 seconds, and so on
          minimum: 1
          maximum: 20
        codes:
          type: array
          title: Retry HTTP codes
          description: List of http codes that trigger a retry. Leave empty to use the
            default list of 429, 500, and 503.
          minItems: 1
          items:
            type: number
            minLength: 1
        enableHeader:
          type: boolean
          title: Honor Retry-After header
          description: Honor any Retry-After header that specifies a delay (in seconds) or
            a timestamp after which to retry the request. The delay is limited
            to 20 seconds, even if the Retry-After header specifies a longer
            delay. When disabled, all Retry-After headers are ignored.
        retryConnectTimeout:
          type: boolean
          title: Retry connection timeout
          description: Make a single retry attempt when a connection timeout (ETIMEDOUT)
            error occurs
        retryConnectReset:
          type: boolean
          title: Retry connection reset
          description: Retry request when a connection reset (ECONNRESET) error occurs
    AuthenticationTypeUse:
      type: object
      title: Authentication
      description: Authentication parameters to use when connecting to brokers. Using
        TLS is highly recommended.
      required:
        - disabled
      properties:
        disabled:
          type: boolean
          title: Disabled
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSaslManualSecret"
        password:
          type: string
          title: Password
          description: Connection-string primary key, or connection-string secondary key,
            from the Event Hubs workspace
        textSecret:
          type: string
          title: Password (text secret)
          description: Select or create a stored text secret
        mechanism:
          $ref: "#/components/schemas/SaslMechanismOptionsSaslOauthbearerPlain"
        username:
          type: string
          title: Username
          description: The username for authentication. For Event Hubs, this should always
            be $ConnectionString.
        clientSecretAuthType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsSaslCertificateManual"
        clientSecret:
          type: string
          title: Client secret
          description: client_secret to pass in the OAuth request parameter
        clientTextSecret:
          type: string
          title: Client secret (text secret)
          description: Select or create a stored text secret
        certificateName:
          type: string
          title: Certificate
          description: Select or create a stored certificate
        certPath:
          type: string
        privKeyPath:
          type: string
        passphrase:
          type: string
        oauthEndpoint:
          $ref: "#/components/schemas/MicrosoftEntraIdAuthenticationEndpointOptionsSasl"
        clientId:
          type: string
          title: Client ID
          description: client_id to pass in the OAuth request parameter
        tenantId:
          type: string
          title: Tenant identifier
          description: Directory ID (tenant identifier) in Azure Active Directory
        scope:
          type: string
          title: Scope
          description: Scope to pass in the OAuth request parameter
        __template_password:
          type: string
          description: Binds 'password' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'password' at runtime.
        __template_mechanism:
          type: string
          description: Binds 'mechanism' to a variable for dynamic value resolution. Set
            to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'mechanism' at runtime.
        __template_oauthEndpoint:
          type: string
          description: Binds 'oauthEndpoint' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'oauthEndpoint' at runtime.
        __template_clientId:
          type: string
          description: Binds 'clientId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'clientId' at runtime.
        __template_tenantId:
          type: string
          description: Binds 'tenantId' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'tenantId' at runtime.
        __template_scope:
          type: string
          description: Binds 'scope' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'scope' at runtime.
    ProcessType:
      type: object
      properties:
        sets:
          type: array
          title: Process sets
          description: Configure sets to collect process metrics
          items:
            $ref: "#/components/schemas/SetConfInputSystemMetrics"
    GpuType:
      type: object
      properties:
        mode:
          $ref: "#/components/schemas/ModeOptionsGpu"
        perGpu:
          type: boolean
          title: Per-GPU metrics
          description: Generate metrics for each GPU
        detail:
          type: boolean
          title: Detailed metrics
          description: Generate full GPU metrics
    RunnableJobCollectionScheduleRunType:
      type: object
      required:
        - mode
      properties:
        rescheduleDroppedTasks:
          type: boolean
          title: Reschedule tasks
          description: Reschedule tasks that failed with non-fatal errors
        maxTaskReschedule:
          type: number
          title: Task reschedule limit
          description: Maximum number of times a task can be rescheduled
          minimum: 1
        logLevel:
          $ref: "#/components/schemas/LogLevelOptionsRunnableJobCollectionScheduleRun"
        jobTimeout:
          title: Job timeout
          type: string
          description: "Maximum time the job is allowed to run. Time unit defaults to
            seconds if not specified (examples: 30, 45s, 15m). Enter 0 for
            unlimited time."
          pattern: \d+[sm]?$
        mode:
          type: string
          title: Mode
          description: Job run mode. Preview will either return up to N matching results,
            or will run until capture time T is reached. Discovery will gather
            the list of files to turn into streaming tasks, without running the
            data collection job. Full Run will run the collection job.
        timeRangeType:
          type: string
          title: Time range
        earliest:
          type:
            - number
            - string
          title: Earliest
          description: Earliest time to collect data for the selected timezone
        latest:
          type:
            - number
            - string
          title: Latest
          description: Latest time to collect data for the selected timezone
        timestampTimezone: {}
        timeWarning:
          $ref: "#/components/schemas/BrokenEventProcessor"
        expression:
          type: string
          title: Filter
          description: A filter for tokens in the provided collect path and/or the events
            being collected
        minTaskSize:
          type: string
          title: Lower task bundle size
          description: >-
            Limits the bundle size for small tasks. For example,
                    if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task.
          pattern: ^((\d*\.?\d+)((KB|MB|GB|TB|PB|EB|ZB|YB|kb|mb|gb|tb|pb|eb|zb|yb){1}))$
        maxTaskSize:
          type: string
          title: Upper task bundle size
          description: >-
            Limits the bundle size for files above the lower task bundle size.
            For example, if your upper bundle size is 10MB,
                    you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks.
          pattern: ^((\d*\.?\d+)((KB|MB|GB|TB|PB|EB|ZB|YB|kb|mb|gb|tb|pb|eb|zb|yb){1}))$
    RunnableJobCollectionTypeCollectionWithBreakerRulesetsConstraint:
      type: object
      properties:
        type:
          type: string
          enum:
            - collection
          x-speakeasy-unknown-values: allow
        breakerRulesets:
          type: array
          title: Event Breaker rulesets
          description: A list of event-breaking rulesets that will be applied, in order,
            to the input data stream
          items:
            type: string
        staleChannelFlushMs:
          type: number
          title: Event Breaker buffer timeout (ms)
          description: How long (in milliseconds) the Event Breaker will wait for new data
            to be sent to a specific channel before flushing the data stream
            out, as is, to the Pipelines
          minimum: 10
          maximum: 43200000
        sendToRoutes:
          type: boolean
          title: Send to Routes
          description: Send events to normal routing and event processing. Disable to
            select a specific Pipeline/Destination combination.
        preprocess:
          $ref: "#/components/schemas/PreprocessType"
        throttleRatePerSec:
          type: string
          title: Throttling
          description: "Rate (in bytes per second) to throttle while writing to an output.
            Accepts values with multiple-byte units, such as KB, MB, and GB.
            (Example: 42 MB) Default value of 0 specifies no throttling."
          pattern: ^[\d.]+(\s[KMGTPEZYkmgtpezy][Bb])?$
        metadata:
          type: array
          title: Fields
          description: Fields to add to events from this input
          items:
            $ref: "#/components/schemas/MetadataConfInputCollection"
        pipeline:
          type: string
          title: Pipeline
          description: Pipeline to process results
        output:
          type: string
          title: Destination
          description: Destination to send results to
    ExecutorTypeRunnableJobExecutor:
      type: object
      required:
        - type
      properties:
        type:
          type: string
          title: Executor type
          description: The type of executor to run
        storeTaskResults:
          type: boolean
          title: Store task results
          description: Determines whether or not to write task results to disk
        conf:
          $ref: "#/components/schemas/ExecutorSpecificSettingsTypeRunnableJobExecutorExec\
            utor"
    TlsSettingsClientSideTypeCaPathCertPathExtended:
      type: object
      title: TLS settings (client side)
      properties:
        disabled:
          type: boolean
          title: Disabled
        servername:
          type: string
          title: Server name (SNI)
          description: Server name for the SNI (Server Name Indication) TLS extension. It
            must be a host name, and not an IP address.
        certificateName:
          type: string
          title: Certificate
          description: The name of the predefined certificate
        caPath:
          type: string
          title: CA certificate path
          description: Path on client in which to find CA certificates to verify the
            server's cert. PEM format. Can reference $ENV_VARS.
        privKeyPath:
          type: string
          title: Private key path (mutual auth)
          description: Path on client in which to find the private key to use. PEM format.
            Can reference $ENV_VARS.
        certPath:
          type: string
          title: Certificate path (mutual auth)
          description: Path on client in which to find certificates to use. PEM format.
            Can reference $ENV_VARS.
        passphrase:
          type: string
          title: Passphrase
          description: Passphrase to use to decrypt private key
        minVersion:
          $ref: "#/components/schemas/MinimumTlsVersionOptionsTls"
        maxVersion:
          $ref: "#/components/schemas/MaximumTlsVersionOptionsTls"
    HostConfOutputSyslog:
      type: object
      required:
        - host
        - port
      properties:
        host:
          type: string
          title: Address
          description: The hostname of the receiver
        port:
          type: number
          title: Port
          maximum: 65535
          description: The port to connect to on the provided host
        tls:
          $ref: "#/components/schemas/TlsOptionsHostsItems"
        servername:
          type: string
          title: TLS Servername
          description: Servername to use if establishing a TLS connection. If not
            specified, defaults to connection host (if not an IP); otherwise,
            uses the global TLS settings.
        weight:
          type: number
          title: Load Weight
          description: Assign a weight (>0) to each endpoint to indicate its
            traffic-handling capability
          minimum: 0
        __template_host:
          type: string
          description: Binds 'host' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'host' at runtime.
        __template_port:
          type: string
          description: Binds 'port' to a variable for dynamic value resolution. Set to
            variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'port' at runtime.
    TlsSettingsClientSideTypeExtended:
      type: object
      title: TLS settings (client side)
      properties:
        disabled:
          type: boolean
          title: Disabled
        rejectUnauthorized:
          type: boolean
          title: Validate server certs
          description: >-
            Reject certificates that are not authorized by a CA in the CA
            certificate path, or by another 
                                trusted CA (such as the system's). Defaults to Enabled. Overrides the toggle from Advanced Settings, when also present.
        certificateName:
          type: string
          title: Certificate
          description: The name of the predefined certificate
        caPath:
          type: string
          title: CA certificate path
          description: Path on client in which to find CA certificates to verify the
            server's cert. PEM format. Can reference $ENV_VARS.
        privKeyPath:
          type: string
          title: Private key path (mutual auth)
          description: Path on client in which to find the private key to use. PEM format.
            Can reference $ENV_VARS.
        certPath:
          type: string
          title: Certificate path (mutual auth)
          description: Path on client in which to find certificates to use. PEM format.
            Can reference $ENV_VARS.
        passphrase:
          type: string
          title: Passphrase
          description: Passphrase to use to decrypt private key
        minVersion:
          $ref: "#/components/schemas/MinimumTlsVersionOptionsTls"
        maxVersion:
          $ref: "#/components/schemas/MaximumTlsVersionOptionsTls"
    AuthTypeTemplatemanualApiKeyAuthType:
      type: object
      required:
        - disabled
      properties:
        disabled:
          type: boolean
          title: Authentication Disabled
        username:
          type: string
          title: Username
        password:
          type: string
          title: Password
        authType:
          $ref: "#/components/schemas/AuthenticationMethodOptionsAuthManualManualApiKey"
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
        manualAPIKey:
          type: string
          title: API key
          description: Enter API key directly
        textSecret:
          type: string
          title: API key (text secret)
          description: Select or create a stored text secret
        __template_manualAPIKey:
          type: string
          description: Binds 'manualAPIKey' to a variable for dynamic value resolution.
            Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID
            (group-scoped). Variable value overrides 'manualAPIKey' at runtime.
    PrometheusAuthType:
      type: object
      properties:
        authType:
          $ref: "#/components/schemas/AuthenticationTypeOptionsPrometheusAuthBasicCredent\
            ialsSecret"
        token:
          type: string
          title: Auth token
          description: "Bearer token to include in the authorization header. In Grafana
            Cloud, this is generally built by concatenating the username and the
            API key, separated by a colon. Example:
            <your-username>:<your-api-key>"
        textSecret:
          type: string
          title: Auth token (text secret)
          description: Select or create a stored text secret
        username:
          type: string
          title: Username
          description: Username for authentication
        password:
          type: string
          title: Password
          description: Password (API key in Grafana Cloud domain) for authentication
        credentialsSecret:
          type: string
          title: Credentials secret
          description: Select or create a secret that references your credentials
    AppscopeConfigTypeNdjsonWithEnableConstraint:
      type: object
      properties:
        enable:
          type: boolean
        format:
          $ref: "#/components/schemas/FormatTypeAppscopeConfigEvent"
        transport:
          $ref: "#/components/schemas/AppscopeTransport"
        type:
          type: string
          const: ndjson
        watch:
          type: array
          items:
            $ref: "#/components/schemas/WatchConfAppscopeConfig"
      required:
        - enable
        - format
        - transport
        - type
        - watch
    LogTypeAppscopeConfigLibscope:
      type: object
      properties:
        level:
          $ref: "#/components/schemas/LevelOptionsAppscopeConfigLibscopeLog"
        transport:
          $ref: "#/components/schemas/AppscopeTransport"
    MetricTypeAppscopeConfig:
      type: object
      properties:
        enable:
          type: boolean
        format:
          $ref: "#/components/schemas/FormatTypeAppscopeConfigMetric"
        transport:
          $ref: "#/components/schemas/AppscopeTransport"
        watch:
          type: array
          items:
            type: string
      required:
        - enable
        - format
        - transport
        - watch
    ColorThresholdsTypeChartElementConfig:
      type: object
      properties:
        thresholds:
          type: array
          items:
            $ref: "#/components/schemas/ThresholdConfChartElementConfig"
          description: Ordered list of threshold breakpoints with associated colors.
      required:
        - thresholds
      description: Color threshold configuration for conditional coloring.
    XAxisTypeChartElementConfig:
      type: object
      properties:
        dataField:
          type: string
          description: Field name for the X-axis data.
        format:
          $ref: "#/components/schemas/FormatTypeChartElementConfigXAxis"
        inverse:
          type: boolean
          description: If <code>true</code>, reverse the axis direction.
        labelInterval:
          type: string
          description: Interval strategy for axis label spacing.
        labelOrientation:
          type: integer
          description: Label rotation angle in degrees.
        name:
          type: string
          description: Display name for the axis.
        offset:
          type: integer
          description: Pixel offset of the axis from its default position.
        position:
          type: string
          description: Axis position.
          example: Bottom
        type:
          type: string
          description: Axis type.
          example: category
      description: X-axis configuration.
    YAxisTypeChartElementConfig:
      type: object
      properties:
        dataField:
          type: array
          items:
            type: string
          description: Field names for the Y-axis data.
        format:
          $ref: "#/components/schemas/FormatTypeChartElementConfigXAxis"
        interval:
          type: number
          description: Fixed interval between axis tick marks.
        max:
          type: number
          description: Maximum value for the axis range.
        min:
          type: number
          description: Minimum value for the axis range.
        position:
          type: string
          description: Axis position.
          example: Left
        scale:
          type: string
          description: Scale type.
          example: Linear
        splitLine:
          type: boolean
          description: If <code>true</code>, show horizontal grid lines.
        type:
          type: string
          description: Axis type.
          example: value
      description: Y-axis configuration.
    DisplayConfigTypeTemplateVisualizationSection:
      allOf:
        - type: object
          additionalProperties: true
        - $ref: "#/components/schemas/TemplateVisualizationSectionDisplayConfigType"
    CacheStatusByDatasetIdUsedCacheFalseWithCacheStatusConstraint:
      type: object
      properties:
        cacheStatus:
          $ref: "#/components/schemas/CacheStatusOptionsCacheStatusByDatasetIdAdditionalP\
            roperties"
        computeType:
          $ref: "#/components/schemas/SearchComputeType"
          description: Compute tier that was recorded when cache was not used.
        reason:
          type: string
          description: Explanation for the cache miss or error.
        usedCache:
          type: boolean
          const: false
          description: If <code>false</code>, the results were not served from cache.
      required:
        - cacheStatus
        - computeType
        - reason
        - usedCache
    InventoryConfigTypeCriblLakeStorageLocationConfig:
      type: object
      description: S3 Inventory configuration for tracking bucket contents.
      readOnly: true
      required:
        - type
        - destinationBucketName
        - destinationPrefix
        - region
      properties:
        type:
          $ref: "#/components/schemas/TypeOptionsCriblLakeStorageLocationConfigInventoryC\
            onfig"
        destinationBucketName:
          type: string
          description: Target bucket where inventory reports are written.
        destinationPrefix:
          type: string
          description: Prefix path under the target bucket for inventory report files.
        region:
          type: string
          description: AWS region of the target bucket.
    CredentialsTypeCriblLakeStorageLocation:
      type: object
      description: Authentication credentials for accessing the storage provider.
      properties:
        method:
          $ref: "#/components/schemas/MethodOptionsCriblLakeStorageLocationCredentials"
        apiKey:
          type: string
          description: AWS access key ID (for manual credentials).
        secretKey:
          type: string
          description: AWS secret access key (for manual credentials).
        roleToAssume:
          type: string
          description: AWS IAM role ARN to assume for accessing the storage.
        roleToAssumeHybrid:
          type: string
          description: AWS IAM role ARN to assume for hybrid deployments.
        roleToAssumeExternalId:
          type: string
          description: External ID required when assuming the IAM role.
          pattern: ^[A-Za-z0-9+=,.@:/-]{2,1224}$
          minLength: 2
          maxLength: 1224
        tenantId:
          type: string
          description: Azure tenant ID (for azure_blob provider).
        clientId:
          type: string
          description: Azure client ID (for azure_blob provider)
        objectId:
          type: string
          description: Azure object ID (service principal object ID, for azure_blob
            provider)
        subscriptionId:
          type: string
          description: Azure subscription ID (for azure_blob provider)
    KubeTypeHeartbeatMetadata:
      type: object
      properties:
        enabled:
          type: boolean
        namespace:
          type: string
        node:
          type: string
        owner:
          $ref: "#/components/schemas/OwnerTypeHeartbeatMetadataKube"
        pod:
          type: string
        source:
          type: string
      required:
        - enabled
        - namespace
        - node
        - pod
        - source
    ApiTypeSystemSettingsConf:
      type: object
      properties:
        baseUrl:
          type: string
        disableApiCache:
          type: boolean
        disabled:
          type: boolean
        headers:
          type: object
          additionalProperties:
            type: string
        host:
          type: string
        idleSessionTTL:
          type: number
        listenOnPort:
          type: boolean
        loginRateLimit:
          type: string
        port:
          type: number
        protocol:
          type: string
        scripts:
          type: boolean
        sensitiveFields:
          type: array
          items:
            type: string
        ssl:
          $ref: "#/components/schemas/SslTypeSystemSettingsConfApi"
        ssoRateLimit:
          type: string
        workerRemoteAccess:
          type: boolean
      required:
        - disabled
        - host
        - port
    SupportTypeSystemSettingsConf:
      type: object
      properties:
        featureFlagOverrides:
          type: array
          items:
            $ref: "#/components/schemas/FeatureFlagOverrideConfSystemSettingsConf"
        logFileMaxFiles:
          type: number
        logFileMaxSize:
          type: string
    SystemTypeSystemSettingsConf:
      type: object
      properties:
        intercom:
          type: boolean
        upgrade:
          $ref: "#/components/schemas/UpgradeOptionsSystemSettingsConfSystem"
      required:
        - intercom
        - upgrade
    EventConfPreviewResponseBody:
      allOf:
        - $ref: "#/components/schemas/PreviewResponseBodyEventsItemsType"
        - type: object
          additionalProperties: true
    KafkaSchemaRegistryAuthenticationType:
      type: object
      title: Kafka Schema Registry Authentication
      required:
        - disabled
      properties:
        disabled:
          type: boolean
          title: Disabled
        schemaRegistryURL:
          type: string
          title: Schema Registry URL
          description: "URL for accessing the Confluent Schema Registry. Example:
            http://localhost:8081. To connect over TLS, use https instead of
            http."
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a Schema Registry connection to complete
            successfully
          minimum: 1000
          maximum: 60000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for the Schema Registry to respond to a request
          minimum: 1000
          maximum: 60000
        maxRetries:
          type: number
          title: Retry limit
          description: Maximum number of times to try fetching schemas from the Schema
            Registry
          minimum: 0
          maximum: 100
        auth:
          $ref: "#/components/schemas/AuthType"
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        __template_schemaRegistryURL:
          type: string
          description: Binds 'schemaRegistryURL' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'schemaRegistryURL' at runtime.
    RunSettingsTypeRunnableJobCollectionSchedule:
      type: object
      title: Run settings
      allOf:
        - $ref: "#/components/schemas/RunnableJobCollectionTypeCollectionConstraint"
        - $ref: "#/components/schemas/RunnableJobCollectionScheduleRunType"
    KafkaSchemaRegistryAuthenticationTypeTemplateschemaRegistryUrlAuth:
      type: object
      title: Kafka Schema Registry Authentication
      required:
        - disabled
      properties:
        disabled:
          type: boolean
          title: Disabled
        schemaRegistryURL:
          type: string
          title: Schema Registry URL
          description: "URL for accessing the Confluent Schema Registry. Example:
            http://localhost:8081. To connect over TLS, use https instead of
            http."
        connectionTimeout:
          type: number
          title: Connection timeout (ms)
          description: Maximum time to wait for a Schema Registry connection to complete
            successfully
          minimum: 1000
          maximum: 60000
        requestTimeout:
          type: number
          title: Request timeout (ms)
          description: Maximum time to wait for the Schema Registry to respond to a request
          minimum: 1000
          maximum: 60000
        maxRetries:
          type: number
          title: Retry limit
          description: Maximum number of times to try fetching schemas from the Schema
            Registry
          minimum: 0
          maximum: 100
        auth:
          $ref: "#/components/schemas/AuthType"
        tls:
          $ref: "#/components/schemas/TlsSettingsClientSideTypeCaPathCertPath"
        defaultKeySchemaId:
          type: number
          title: Default key schema ID
          description: Used when __keySchemaIdOut is not present, to transform key values,
            leave blank if key transformation is not required by default.
        defaultValueSchemaId:
          type: number
          title: Default value schema ID
          description: Used when __valueSchemaIdOut is not present, to transform _raw,
            leave blank if value transformation is not required by default.
        __template_schemaRegistryURL:
          type: string
          description: Binds 'schemaRegistryURL' to a variable for dynamic value
            resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.'
            prefixed ID (group-scoped). Variable value overrides
            'schemaRegistryURL' at runtime.
    LibscopeTypeAppscopeConfig:
      type: object
      properties:
        commanddir:
          type: string
        configevent:
          type: boolean
        log:
          $ref: "#/components/schemas/LogTypeAppscopeConfigLibscope"
        summaryperiod:
          type: number
    RunSettingsTypeSavedJobResponseCollectionSchedule:
      type: object
      title: Run settings
      allOf:
        - $ref: "#/components/schemas/RunnableJobCollectionTypeCollectionConstraint"
        - $ref: "#/components/schemas/RunnableJobCollectionScheduleRunType"
    ConfigTypeCriblLakeStorageLocation:
      type: object
      description: Provider-specific storage configuration.
      readOnly: true
      properties:
        region:
          type: string
          description: Cloud region where the storage resides.
        bucketName:
          type: string
          description: AWS S3 bucket name backing the Storage Location.
          pattern: ^[a-z0-9][a-z0-9-.]{1,61}[a-z0-9]$
          minLength: 3
          maxLength: 63
        storageAccountName:
          type: string
          description: Azure storage account name (for azure_blob provider)
        resourceGroupName:
          type: string
          description: Azure Resource Group name (for azure_blob provider)
        retentionPeriodInDays:
          type: integer
          minimum: 1
          description: Storage account-level retention period, in days. Supported only for
            Azure-backed Cribl Lake Destinations.
        encryption:
          $ref: "#/components/schemas/EncryptionOptionsCriblLakeStorageLocationConfig"
        inventoryConfig:
          $ref: "#/components/schemas/InventoryConfigTypeCriblLakeStorageLocationConfig"
    ScheduleTypeRunnableJobCollection:
      type: object
      title: Schedule
      description: Configuration for a scheduled job
      properties:
        enabled:
          type: boolean
          title: Enabled
          description: Enable to configure scheduling for this Collector
        skippable:
          type: boolean
          title: Skippable
          description: Skippable jobs can be delayed, up to their next run time, if the
            system is hitting concurrency limits
        resumeMissed:
          type: boolean
          title: Resume missed runs
          description: If Stream Leader (or single instance) restarts, run all missed jobs
            according to their original schedules
        cronSchedule:
          type: string
          title: Cron schedule
          description: A cron schedule on which to run this job
        maxConcurrentRuns:
          type: number
          title: Concurrent run limit
          description: The maximum number of instances of this scheduled job that may be
            running at any time
          minimum: 1
        run:
          $ref: "#/components/schemas/RunSettingsTypeRunnableJobCollectionSchedule"
    ScheduleTypeSavedJobResponseCollection:
      type: object
      title: Schedule
      description: Configuration for a scheduled job
      properties:
        enabled:
          type: boolean
          title: Enabled
          description: Enable to configure scheduling for this Collector
        skippable:
          type: boolean
          title: Skippable
          description: Skippable jobs can be delayed, up to their next run time, if the
            system is hitting concurrency limits
        resumeMissed:
          type: boolean
          title: Resume missed runs
          description: If Stream Leader (or single instance) restarts, run all missed jobs
            according to their original schedules
        cronSchedule:
          type: string
          title: Cron schedule
          description: A cron schedule on which to run this job
        maxConcurrentRuns:
          type: number
          title: Concurrent run limit
          description: The maximum number of instances of this scheduled job that may be
            running at any time
          minimum: 1
        run:
          $ref: "#/components/schemas/RunSettingsTypeSavedJobResponseCollectionSchedule"
  examples:
    AclApplyProjectExamplesGrantAccess:
      summary: Grant a Project policy to Members
      description: Example request body for granting a Project policy to the specified
        Members.
      value:
        add:
          ProjectRead:
            - user1@example.com
            - user2@example.com
    AclApplyProjectExamplesRevokeAccess:
      summary: Revoke a Project policy from Members
      description: Example request body for revoking a Project policy from the
        specified Members.
      value:
        rm:
          ProjectMaintain:
            - user3@example.com
    AclTeamsApplyProjectExamplesGrantTeamAccess:
      summary: Grant a Project policy to Teams
      description: Example request body for granting a Project policy to the specified
        Teams.
      value:
        add:
          ProjectRead:
            - engineering-team
            - data-team
    AclTeamsApplyProjectExamplesRevokeTeamAccess:
      summary: Revoke a Project policy from Teams
      description: Example request body for revoking a Project policy from the
        specified Teams.
      value:
        rm:
          ProjectMaintain:
            - former-team
    AclApplyResponseExamplesSuccess:
      summary: Successful ACL modification
      description: Response after successfully modifying ACL permissions.
      value:
        items: []
    CreateSubscriptionExamplesBasicSubscription:
      summary: Create a Subscription
      description: Example request body for creating a new Subscription and
        associating it with a Pipeline.
      value:
        id: my-subscription
        pipeline: main
        description: Subscription for ingesting syslog data
    UpdateSubscriptionExamplesUpdateSubscription:
      summary: Update a Subscription
      description: Example request body for updating the Pipeline assignment and
        description for an existing Subscription.<br/><br/>The request body must
        include a complete representation of the Subscription that you want to
        update. This endpoint does not support partial updates.
      value:
        id: my-subscription
        pipeline: main
        description: Subscription with test Pipeline
        disabled: false
    DatabaseConnectionExamplesMySQLWithConnectionString:
      summary: MySQL with connection string
      description: Create a MySQL database connection using a connection string with
        embedded credentials
      value:
        id: mysql-prod-db
        description: Production MySQL database for customer data
        databaseType: mysql
        authType: connectionString
        connectionString: mysql://admin:password123@mysql.example.com:3306/production?ssl=true
        connectionTimeout: 10000
        tags: production,mysql,customer-data
    DatabaseConnectionExamplesMySQLWithSecret:
      summary: MySQL with secret
      description: Create a MySQL database connection using a stored secret for the
        connection string
      value:
        id: mysql-analytics-db
        description: Analytics MySQL database
        databaseType: mysql
        authType: secret
        textSecret: mysql-analytics-connection
        connectionTimeout: 15000
        tags: analytics,mysql
    DatabaseConnectionExamplesPostgreSQLWithConnectionString:
      summary: PostgreSQL with connection string
      description: Create a PostgreSQL database connection using a connection string
      value:
        id: postgres-warehouse
        description: Data warehouse PostgreSQL database
        databaseType: postgres
        authType: connectionString
        connectionString: postgresql://warehouse_user:SecurePass456@postgres.example.com:5432/warehouse?sslmode=require
        connectionTimeout: 15000
        tags: warehouse,postgres,reporting
    DatabaseConnectionExamplesPostgreSQLWithSecret:
      summary: PostgreSQL with secret
      description: Create a PostgreSQL database connection using a stored secret
      value:
        id: postgres-logs
        description: Logs PostgreSQL database
        databaseType: postgres
        authType: secret
        textSecret: postgres-logs-connection
        connectionTimeout: 10000
        tags: logs,postgres
    DatabaseConnectionExamplesSQLServerWithConnectionString:
      summary: SQL Server with connection string
      description: Create a SQL Server database connection using a connection string
      value:
        id: sqlserver-erp
        description: ERP SQL Server database
        databaseType: sqlserver
        authType: connectionString
        connectionString: Server=sqlserver.example.com;Database=ERP;User
          Id=erp_admin;Password=ERP_Pass789!;Encrypt=true
        connectionTimeout: 15000
        requestTimeout: 30000
        tags: erp,sqlserver,finance
    DatabaseConnectionExamplesSQLServerWithSecret:
      summary: SQL Server with secret
      description: Create a SQL Server database connection using a stored secret
      value:
        id: sqlserver-crm
        description: CRM SQL Server database
        databaseType: sqlserver
        authType: secret
        textSecret: sqlserver-crm-connection
        connectionTimeout: 15000
        requestTimeout: 15000
        tags: crm,sqlserver,sales
    DatabaseConnectionExamplesSQLServerWithConfigObject:
      summary: SQL Server with config object
      description: Create a SQL Server database connection using a configuration
        object for advanced settings
      value:
        id: sqlserver-reporting
        description: Reporting SQL Server database with custom config
        databaseType: sqlserver
        authType: configObj
        configObj: '{"server":"sqlserver.example.com","database":"Reporting","user":"report_user","password":"Report_Pass123!","options":{"encrypt":true,"trustServerCertificate":false,"connectTimeout":20000}}'
        requestTimeout: 60000
        tags: reporting,sqlserver,analytics
    DatabaseConnectionExamplesOracleWithConnectionString:
      summary: Oracle with connection string
      description: Create an Oracle database connection using Easy Connect format with
        credentials
      value:
        id: oracle-erp
        description: Oracle ERP database
        databaseType: oracle
        authType: connectionString
        connectionString: oracle.example.com:1521/ORCL
        user: erp_user
        password: Oracle_Pass456!
        connectionTimeout: 15000
        tags: erp,oracle,finance
    DatabaseConnectionExamplesOracleWithSecret:
      summary: Oracle with secret
      description: Create an Oracle database connection using a stored secret for the
        connection string
      value:
        id: oracle-warehouse
        description: Oracle data warehouse
        databaseType: oracle
        authType: secret
        textSecret: oracle-warehouse-connection
        user: warehouse_user
        password: Warehouse_Pass789!
        connectionTimeout: 20000
        tags: warehouse,oracle,reporting
    DatabaseConnectionExamplesOracleWithCredentialsSecrets:
      summary: Oracle with credentials secrets
      description: Create an Oracle database connection using separate secrets for
        credentials and connection string
      value:
        id: oracle-secure-db
        description: High-security Oracle database with credential secrets
        databaseType: oracle
        authType: secrets
        credsSecrets: oracle-secure-credentials
        textSecret: oracle-secure-connection
        connectionTimeout: 15000
        tags: secure,oracle,sensitive-data
    UpdateDatabaseConnectionExamplesMySQLWithConnectionString:
      summary: Update MySQL with connection string
      description: Example request body for updating a Database
        Connection.<br/><br/>The request body must include a complete
        representation of the Database Connection that you want to update. This
        endpoint does not support partial updates.
      value:
        id: mysql-prod-db
        description: Production MySQL database for customer data
        databaseType: mysql
        authType: connectionString
        connectionString: mysql://admin:password123@mysql.example.com:3306/production?ssl=true
        connectionTimeout: 10000
        tags: production,mysql,customer-data
    UpdateDatabaseConnectionExamplesMySQLWithSecret:
      summary: Update MySQL with secret
      description: Example request body for updating a Database
        Connection.<br/><br/>The request body must include a complete
        representation of the Database Connection that you want to update. This
        endpoint does not support partial updates.
      value:
        id: mysql-analytics-db
        description: Analytics MySQL database
        databaseType: mysql
        authType: secret
        textSecret: mysql-analytics-connection
        connectionTimeout: 15000
        tags: analytics,mysql
    UpdateDatabaseConnectionExamplesPostgreSQLWithConnectionString:
      summary: Update PostgreSQL with connection string
      description: Example request body for updating a Database
        Connection.<br/><br/>The request body must include a complete
        representation of the Database Connection that you want to update. This
        endpoint does not support partial updates.
      value:
        id: postgres-warehouse
        description: Data warehouse PostgreSQL database
        databaseType: postgres
        authType: connectionString
        connectionString: postgresql://warehouse_user:SecurePass456@postgres.example.com:5432/warehouse?sslmode=require
        connectionTimeout: 15000
        tags: warehouse,postgres,reporting
    UpdateDatabaseConnectionExamplesPostgreSQLWithSecret:
      summary: Update PostgreSQL with secret
      description: Example request body for updating a Database
        Connection.<br/><br/>The request body must include a complete
        representation of the Database Connection that you want to update. This
        endpoint does not support partial updates.
      value:
        id: postgres-logs
        description: Logs PostgreSQL database
        databaseType: postgres
        authType: secret
        textSecret: postgres-logs-connection
        connectionTimeout: 10000
        tags: logs,postgres
    UpdateDatabaseConnectionExamplesSQLServerWithConnectionString:
      summary: Update SQL Server with connection string
      description: Example request body for updating a Database
        Connection.<br/><br/>The request body must include a complete
        representation of the Database Connection that you want to update. This
        endpoint does not support partial updates.
      value:
        id: sqlserver-erp
        description: ERP SQL Server database
        databaseType: sqlserver
        authType: connectionString
        connectionString: Server=sqlserver.example.com;Database=ERP;User
          Id=erp_admin;Password=ERP_Pass789!;Encrypt=true
        connectionTimeout: 15000
        requestTimeout: 30000
        tags: erp,sqlserver,finance
    UpdateDatabaseConnectionExamplesSQLServerWithSecret:
      summary: Update SQL Server with secret
      description: Example request body for updating a Database
        Connection.<br/><br/>The request body must include a complete
        representation of the Database Connection that you want to update. This
        endpoint does not support partial updates.
      value:
        id: sqlserver-crm
        description: CRM SQL Server database
        databaseType: sqlserver
        authType: secret
        textSecret: sqlserver-crm-connection
        connectionTimeout: 15000
        requestTimeout: 15000
        tags: crm,sqlserver,sales
    UpdateDatabaseConnectionExamplesSQLServerWithConfigObject:
      summary: Update SQL Server with config object
      description: Example request body for updating a Database
        Connection.<br/><br/>The request body must include a complete
        representation of the Database Connection that you want to update. This
        endpoint does not support partial updates.
      value:
        id: sqlserver-reporting
        description: Reporting SQL Server database with custom config
        databaseType: sqlserver
        authType: configObj
        configObj: '{"server":"sqlserver.example.com","database":"Reporting","user":"report_user","password":"Report_Pass123!","options":{"encrypt":true,"trustServerCertificate":false,"connectTimeout":20000}}'
        requestTimeout: 60000
        tags: reporting,sqlserver,analytics
    UpdateDatabaseConnectionExamplesOracleWithConnectionString:
      summary: Update Oracle with connection string
      description: Example request body for updating a Database
        Connection.<br/><br/>The request body must include a complete
        representation of the Database Connection that you want to update. This
        endpoint does not support partial updates.
      value:
        id: oracle-erp
        description: Oracle ERP database
        databaseType: oracle
        authType: connectionString
        connectionString: oracle.example.com:1521/ORCL
        user: erp_user
        password: Oracle_Pass456!
        connectionTimeout: 15000
        tags: erp,oracle,finance
    UpdateDatabaseConnectionExamplesOracleWithSecret:
      summary: Update Oracle with secret
      description: Example request body for updating a Database
        Connection.<br/><br/>The request body must include a complete
        representation of the Database Connection that you want to update. This
        endpoint does not support partial updates.
      value:
        id: oracle-warehouse
        description: Oracle data warehouse
        databaseType: oracle
        authType: secret
        textSecret: oracle-warehouse-connection
        user: warehouse_user
        password: Warehouse_Pass789!
        connectionTimeout: 20000
        tags: warehouse,oracle,reporting
    UpdateDatabaseConnectionExamplesOracleWithCredentialsSecrets:
      summary: Update Oracle with credentials secrets
      description: Example request body for updating a Database
        Connection.<br/><br/>The request body must include a complete
        representation of the Database Connection that you want to update. This
        endpoint does not support partial updates.
      value:
        id: oracle-secure-db
        description: High-security Oracle database with credential secrets
        databaseType: oracle
        authType: secrets
        credsSecrets: oracle-secure-credentials
        textSecret: oracle-secure-connection
        connectionTimeout: 15000
        tags: secure,oracle,sensitive-data
    DatabaseConnectionTestExamplesMySQLConnectionString:
      summary: Test MySQL connection with connection string
      description: Example request body for testing connectivity to a MySQL database
        using a connection string with embedded credentials.
      value:
        databaseType: mysql
        authType: connectionString
        connectionString: mysql://admin:password@mysql.example.com:3306/production
        connectionTimeout: 10000
    DatabaseConnectionTestExamplesPostgresSecret:
      summary: Test PostgreSQL connection with secret
      description: Example request body for testing connectivity to a PostgreSQL
        database using a secret that stores the connection string.
      value:
        databaseType: postgres
        authType: secret
        textSecret: postgres-connection-secret
        connectionTimeout: 10000
    DatabaseConnectionTestExamplesSQLServerConfigObj:
      summary: Test SQL Server connection with configuration object
      description: Example request body for testing connectivity to a SQL Server
        database using a JSON configuration object with encryption options.
      value:
        databaseType: sqlserver
        authType: configObj
        configObj: '{"server":"sqlserver.example.com","database":"production","options":{"encrypt":true,"trustServerCertificate":false}}'
    DatabaseConnectionTestExamplesOracleCredentials:
      summary: Test Oracle connection with secrets
      description: Example request body for testing connectivity to an Oracle database
        using separate secrets for credentials and the connection string.
      value:
        databaseType: oracle
        authType: secrets
        textSecret: oracle-connection-secret
        credsSecrets: oracle-credentials
        connectionTimeout: 15000
    EventBreakerRuleExamplesRegexBreaker:
      summary: Regex-based Event Breaker Ruleset
      description: Example request body for creating an Event Breaker Ruleset with one
        Rule that uses a regex pattern to split syslog messages into individual
        events.
      value:
        id: custom-syslog-breaker
        lib: custom
        description: Event Breaker Ruleset for syslog messages
        minRawLength: 256
        rules:
          - name: syslog
            condition: "true"
            type: regex
            eventBreakerRegex: /^\w{3}\s+\d+\s+\d+:\d+:\d+/m
            timestampAnchorRegex: /^/
            timestampTimezone: UTC
            timestamp:
              type: auto
              length: 150
            maxEventBytes: 51200
    EventBreakerRuleExamplesJsonBreaker:
      summary: JSON Event Breaker Ruleset
      description: Example request body for creating an Event Breaker Ruleset with one
        Rule that splits JSON log streams into individual JSON events with
        automatic timestamp extraction.
      value:
        id: json-log-breaker
        lib: custom
        description: Event Breaker Ruleset for JSON log events
        minRawLength: 256
        rules:
          - name: json-events
            condition: "true"
            type: json
            timestampAnchorRegex: /^/
            timestampTimezone: UTC
            timestamp:
              type: auto
              length: 150
            maxEventBytes: 51200
            jsonExtractAll: true
            jsonTimeField: timestamp
    EventBreakerRuleExamplesCsvBreaker:
      summary: CSV Event Breaker Ruleset
      description: Example request body for creating an Event Breaker Ruleset with one
        Rule that splits CSV-formatted data into individual events using
        line-based breaking.
      value:
        id: csv-data-breaker
        lib: custom
        description: Event Breaker Ruleset for CSV-formatted data
        minRawLength: 256
        rules:
          - name: csv-events
            condition: "true"
            type: csv
            timestampAnchorRegex: /^/
            timestampTimezone: UTC
            timestamp:
              type: auto
              length: 150
            maxEventBytes: 51200
            delimiter: ","
            quoteChar: '"'
            escapeChar: \
    MoveEventBreakerRulesetContextExamplesIntoPack:
      summary: Move an Event Breaker Ruleset to a Pack
      description: Example request body for moving an Event Breaker Ruleset from the
        global context to a Pack.
      value:
        context:
          type: pack
          id: destination_pack
    MoveEventBreakerRulesetContextExamplesToGlobal:
      summary: Move an Event Breaker Ruleset to the global context
      description: Example request body for moving an Event Breaker Ruleset from a
        Pack to the global context by passing null as the context.
      value:
        context: null
    GlobalVarExamplesStringVariable:
      summary: String-type Global Variable
      description: Example request body for creating a string-type Global Variable for
        storing static configuration values like environment names.
      value:
        id: app_environment
        lib: custom
        type: string
        description: Global Variable for application environment name
        value: production
    GlobalVarExamplesNumberVariable:
      summary: Number-type Global Variable
      description: Example request body for creating a number-type Global Variable for
        storing numeric configuration values like thresholds and limits.
      value:
        id: max_batch_size
        lib: custom
        type: number
        description: Global Variable for maximum batch size for processing
        value: "1000"
    GlobalVarExamplesExpressionVariable:
      summary: Expression-type Global Variable
      description: Example request body for creating an expression-type Global
        Variable that dynamically computes a value based on the specified
        arguments.
      value:
        id: dynamic_threshold
        lib: custom
        type: expression
        description: Global Variable that computes a dynamic threshold based on the
          specified args
        value: rate * 1.5
        args:
          - name: rate
            type: number
    HmacFunctionExamplesSHA256Webhook:
      summary: SHA-256 HMAC Function for webhook authentication
      description: Example request body for creating an HMAC Function that generates a
        SHA-256 signature header for authenticating outbound webhook requests.
      value:
        id: sha256-webhook-hmac
        lib: custom
        description: HMAC Function that generates a SHA256 signature for webhook request
          authentication
        stringBuilders:
          - __e['__rawEvent']
        headerName: X-Signature
        headerExpression: "`sha256=${C.Crypto.createHmac('sha256',
          secretKey).update(hashString).digest('hex')}`"
    HmacFunctionExamplesSHA1Legacy:
      summary: SHA-1 HMAC Function for legacy integrations
      description: Example request body for creating an HMAC Function that generates a
        SHA-1 signature in the Authorization header for legacy API
        compatibility.
      value:
        id: sha1-legacy-hmac
        lib: custom
        description: HMAC Function that generates a SHA1 signature for legacy API
          compatibility
        stringBuilders:
          - __e['_raw']
        headerName: Authorization
        headerExpression: "`HMAC ${C.Crypto.createHmac('sha1',
          secretKey).update(hashString).digest('base64')}`"
    HecTokenExamplesHecToken:
      summary: Basic HEC token
      description: Example request body for adding an HEC token with metadata to a
        Splunk HEC Source.
      value:
        enabled: true
        metadata:
          - name: fieldX
            value: valueX
        token: "12345678901"
    HecTokenExamplesHecTokenWithIndexAccess:
      summary: HEC token with allowed indexes
      description: Example request body for adding an HEC token with index-level
        access control.
      value:
        enabled: true
        allowedIndexesAtToken:
          - myIndex6
        token: "12345678901"
    InputCreateExamplesAnthropicCompliance:
      summary: Anthropic Compliance
      value:
        id: anthropic-compliance-source
        type: anthropic_compliance
        textSecret: anthropic-api-key-secret
        contentConfig:
          - contentType: activities
            contentDescription: Compliance Activities
            enabled: true
            cronSchedule: "*/5 * * * *"
            earliest: -7d@d
            latest: now
            jobTimeout: "300"
            stateTracking: true
            stateUpdateExpression: "__timestampExtracted !== false && {latestTime:
              (state.latestTime || 0) > _time ? state.latestTime : _time}"
            stateMergeExpression: "prevState.latestTime > newState.latestTime ? prevState : newState"
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesAppleUnifiedLogs:
      summary: Apple Unified Logs
      value:
        id: apple-unified-logs-source
        type: apple_unified_logs
        predicate: subsystem == "com.apple.security"
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesAppscope:
      summary: AppScope
      value:
        id: appscope-source
        type: appscope
        host: 0.0.0.0
        port: 9109
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesAzureBlob:
      summary: Azure Blob
      value:
        id: azure-blob-source
        type: azure_blob
        queueName: azure-blob-queue
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesCloudflareHec:
      summary: Cloudflare HEC
      value:
        id: cloudflare-hec-source
        type: cloudflare_hec
        host: 0.0.0.0
        port: 8088
        hecAPI: /services/collector
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesConfluentCloud:
      summary: Confluent Cloud
      value:
        id: confluent-cloud-source
        type: confluent_cloud
        brokers:
          - pkc-xxxxx.us-east-1.aws.confluent.cloud:9092
        topics:
          - logs
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesCollection:
      summary: Collection
      value:
        id: collection-source
        type: collection
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesCriblHttp:
      summary: Cribl HTTP
      value:
        id: cribl-http-source
        type: cribl_http
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesCriblLakeHttp:
      summary: Cribl Lake HTTP
      value:
        id: cribl-lake-http-source
        type: cribl_lake_http
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesCriblTcp:
      summary: Cribl TCP
      value:
        id: cribl-tcp-source
        type: cribl_tcp
        host: 0.0.0.0
        port: 10090
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesCrowdstrike:
      summary: CrowdStrike FDR
      value:
        id: crowdstrike-source
        type: crowdstrike
        queueName: crowdstrike-queue
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesDatadogAgent:
      summary: Datadog Agent
      value:
        id: datadog-agent-source
        type: datadog_agent
        host: 0.0.0.0
        port: 8126
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesDatagen:
      summary: Datagen
      value:
        id: datagen-source
        type: datagen
        samples:
          - sample: sample.json
            eventsPerSec: 10
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesEdgePrometheus:
      summary: Edge Prometheus
      value:
        id: edge-prometheus-source
        type: edge_prometheus
        interval: 60
        discoveryType: static
        targets:
          - host: localhost
            scrapeProtocol: http
            scrapePort: 9090
            scrapePath: /metrics
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesElastic:
      summary: Elasticsearch
      value:
        id: elastic-source
        type: elastic
        host: localhost
        port: 9200
        elasticAPI: /
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesEventhub:
      summary: Event Hubs
      value:
        id: eventhub-source
        type: eventhub
        brokers:
          - myeventhub.servicebus.windows.net:9093
        topics:
          - logs
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesEventhubAmqp:
      summary: Event Hubs AMQP
      value:
        id: eventhub-amqp-source
        type: eventhub_amqp
        eventHubName: my-event-hub
        consumerGroup: $Default
        checkpointing:
          blobStore:
            containerName: my-container
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesExec:
      summary: Exec
      value:
        id: exec-source
        type: exec
        command: echo "Hello World"
        interval: 60
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesFile:
      summary: File Monitor
      value:
        id: file-source
        type: file
        mode: manual
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesFirehose:
      summary: Firehose
      value:
        id: firehose-source
        type: firehose
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesGrafana:
      summary: Grafana
      value:
        id: grafana-source
        type: grafana
        host: 0.0.0.0
        port: 10080
        prometheusAPI: /api/prom/push
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesGooglePubsub:
      summary: Google Pub/Sub
      value:
        id: google-pubsub-source
        type: google_pubsub
        subscriptionName: my-subscription
        topicName: my-topic
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesHttp:
      summary: HTTP
      value:
        id: http-source
        type: http
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesHttpRaw:
      summary: HTTP Raw
      value:
        id: http-raw-source
        type: http_raw
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesJournalFiles:
      summary: Journal Files
      value:
        id: journal-files-source
        type: journal_files
        path: /var/log/journal
        journals:
          - system
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesKafka:
      summary: Kafka
      value:
        id: kafka-source
        type: kafka
        brokers:
          - localhost:9092
        topics:
          - logs
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesKinesis:
      summary: Kinesis
      value:
        id: kinesis-source
        type: kinesis
        streamName: my-stream
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesKubeEvents:
      summary: Kubernetes Events
      value:
        id: kube-events-source
        type: kube_events
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesKubeLogs:
      summary: Kubernetes Logs
      value:
        id: kube-logs-source
        type: kube_logs
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesKubeMetrics:
      summary: Kubernetes Metrics
      value:
        id: kube-metrics-source
        type: kube_metrics
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesLoki:
      summary: Loki
      value:
        id: loki-source
        type: loki
        host: 0.0.0.0
        port: 10080
        lokiAPI: /loki/api/v1/push
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesMetrics:
      summary: Metrics
      value:
        id: metrics-source
        type: metrics
        host: 0.0.0.0
        udpPort: 8125
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesModelDrivenTelemetry:
      summary: Model Driven Telemetry
      value:
        id: mdt-source
        type: model_driven_telemetry
        host: 0.0.0.0
        port: 57000
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesMsk:
      summary: MSK
      value:
        id: msk-source
        type: msk
        brokers:
          - b-1.example.xxxxx.c2.kafka.us-east-1.amazonaws.com:9092
        topics:
          - logs
        region: us-east-1
        awsAuthenticationMethod: auto
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesNetflow:
      summary: Netflow
      value:
        id: netflow-source
        type: netflow
        host: 0.0.0.0
        port: 2055
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesOffice365Mgmt:
      summary: Microsoft 365 Management Activity
      value:
        id: office365-mgmt-source
        type: office365_mgmt
        tenantId: tenant-id
        appId: app-id
        planType: enterprise_gcc
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesMicrosoftGraph:
      summary: Microsoft Graph
      value:
        id: microsoft-graph-source
        type: microsoft_graph
        url: https://graph.microsoft.com/v1.0/admin/exchange/tracing/messageTraces
        interval: 15
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesOffice365MsgTrace:
      summary: Microsoft 365 Message Trace
      value:
        id: office365-msg-trace-source
        type: office365_msg_trace
        url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace
        interval: 15
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesOffice365Service:
      summary: Microsoft 365 Services
      value:
        id: office365-service-source
        type: office365_service
        tenantId: tenant-id
        appId: app-id
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesOkta:
      summary: Okta
      value:
        id: okta-source
        type: okta
        textSecret: okta-api-token-secret
        oktaDomain: your-org
        cronSchedule: "*/5 * * * *"
        earliest: -7d@d
        latest: now
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesOpenAI:
      summary: OpenAI
      value:
        id: openai-source
        type: openai
        textSecret: openai-api-key-secret
        contentConfig:
          - contentType: Audit Logs
            contentDescription: Get organization audit logs.
            collectPath: /v1/organization/audit_logs
            requestParams:
              - name: effective_at[gt]
                value: "`${Math.round(Date.now()/1000 - 3600)}`"
              - name: limit
                value: "100"
            paginationType: response_body
            paginationAttribute:
              - last_id
            paginationLastPageExpr: has_more === false
            cronSchedule: 0 * * * *
            earliest: -1h
            latest: now
            disabled: false
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesOpenAIComplianceLogs:
      summary: OpenAI Compliance Logs
      value:
        id: openai-compliance-logs-source
        type: openai_compliance_logs
        textSecret: openai-api-key-secret
        accountType: workspace
        workspaceId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
        workspaceEventTypes:
          - AUDIT_LOG
          - AUTH_LOG
        cronSchedule: "*/15 * * * *"
        earliest: -1h
        latest: now
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesOpenTelemetry:
      summary: OpenTelemetry
      value:
        id: otel-source
        type: open_telemetry
        host: 0.0.0.0
        port: 4317
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesPrometheus:
      summary: Prometheus Scraper
      value:
        id: prometheus-source
        type: prometheus
        interval: 60
        logLevel: info
        discoveryType: static
        targetList:
          - http://localhost:9090/metrics
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesPrometheusRw:
      summary: Prometheus Remote Write
      value:
        id: prometheus-rw-source
        type: prometheus_rw
        host: 0.0.0.0
        port: 10080
        prometheusAPI: /write
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesRawUdp:
      summary: Raw UDP
      value:
        id: raw-udp-source
        type: raw_udp
        host: 0.0.0.0
        port: 514
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesS3:
      summary: S3
      value:
        id: s3-source
        type: s3
        queueName: s3-notifications-queue
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesS3Inventory:
      summary: S3 Inventory
      value:
        id: s3-inventory-source
        type: s3_inventory
        queueName: s3-inventory-queue
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesSecurityLake:
      summary: Security Lake
      value:
        id: security-lake-source
        type: security_lake
        queueName: security-lake-queue
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesServiceNowTable:
      summary: ServiceNow Table API
      value:
        id: servicenow-table-source
        type: servicenow_table
        instance: https://example.service-now.com
        tableName: incident
        fields:
          - sys_id
          - number
          - short_description
        pageSize: 10000
        cronSchedule: 0 * * * *
        earliest: -1d
        latest: now
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesSnmp:
      summary: SNMP
      value:
        id: snmp-source
        type: snmp
        host: 192.168.1.1
        port: 161
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesSplunk:
      summary: Splunk TCP
      value:
        id: splunk-source
        type: splunk
        host: 0.0.0.0
        port: 9997
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesSplunkHec:
      summary: Splunk HEC
      value:
        id: splunk-hec-source
        type: splunk_hec
        host: 0.0.0.0
        port: 8088
        splunkHecAPI: /services/collector
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesSplunkSearch:
      summary: Splunk Search
      value:
        id: splunk-search-source
        type: splunk_search
        authType: basic
        searchHead: https://localhost:8089
        search: index=main
        cronSchedule: "*/15 * * * *"
        endpoint: /services/search/v2/jobs/export
        outputMode: json
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesSqs:
      summary: SQS
      value:
        id: sqs-source
        type: sqs
        queueName: my-queue
        queueType: standard
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesSyslog:
      summary: Syslog
      value:
        id: syslog-source
        type: syslog
        host: 0.0.0.0
        udpPort: 514
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesSystemMetrics:
      summary: System Metrics
      value:
        id: system-metrics-source
        type: system_metrics
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesSystemState:
      summary: System State
      value:
        id: system-state-source
        type: system_state
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesTcp:
      summary: TCP
      value:
        id: tcp-source
        type: tcp
        host: 0.0.0.0
        port: 10090
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesTcpjson:
      summary: TCP JSON
      value:
        id: tcpjson-source
        type: tcpjson
        host: 0.0.0.0
        port: 10090
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesWef:
      summary: Windows Event Forwarder
      value:
        id: wef-source
        type: wef
        host: 0.0.0.0
        port: 5985
        privKeyPath: /path/to/private.key
        certPath: /path/to/certificate.crt
        caPath: /path/to/ca.crt
        subscriptions:
          - subscriptionName: subscription-1
            contentFormat: RenderedText
            heartbeatInterval: 60
            batchTimeout: 5
            targets: []
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesWinEventLogs:
      summary: Windows Event Logs
      value:
        id: win-event-logs-source
        type: win_event_logs
        logNames:
          - Application
          - System
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesWindowsMetrics:
      summary: Windows Metrics
      value:
        id: windows-metrics-source
        type: windows_metrics
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesWiz:
      summary: Wiz API
      value:
        id: wiz-source
        type: wiz
        endpoint: https://api.wiz.io
        authUrl: https://auth.wiz.io/oauth/token
        clientId: client-id
        contentConfig: []
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesWizWebhook:
      summary: Wiz Webhook
      value:
        id: wiz-webhook-source
        type: wiz_webhook
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
    InputCreateExamplesZscalerHec:
      summary: Zscaler Cloud NSS
      value:
        id: zscaler-hec-source
        type: zscaler_hec
        host: 0.0.0.0
        port: 8088
        hecAPI: /services/collector
        sendToRoutes: true
        pqEnabled: false
    UpdateInputExamplesAnthropicCompliance:
      summary: Anthropic Compliance
      value:
        id: anthropic-compliance-source
        type: anthropic_compliance
        textSecret: anthropic-api-key-secret
        contentConfig:
          - contentType: activities
            contentDescription: Compliance Activities
            enabled: true
            cronSchedule: "*/5 * * * *"
            earliest: -7d@d
            latest: now
            jobTimeout: "300"
            stateTracking: true
            stateUpdateExpression: "__timestampExtracted !== false && {latestTime:
              (state.latestTime || 0) > _time ? state.latestTime : _time}"
            stateMergeExpression: "prevState.latestTime > newState.latestTime ? prevState : newState"
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Anthropic Compliance
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesAppleUnifiedLogs:
      summary: Apple Unified Logs
      value:
        id: apple-unified-logs-source
        type: apple_unified_logs
        predicate: subsystem == "com.apple.security"
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Apple Unified Logs
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesAppscope:
      summary: AppScope
      value:
        id: appscope-source
        type: appscope
        host: 0.0.0.0
        port: 9109
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a AppScope Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesAzureBlob:
      summary: Azure Blob
      value:
        id: azure-blob-source
        type: azure_blob
        queueName: azure-blob-queue
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Azure Blob Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesCloudflareHec:
      summary: Cloudflare HEC
      value:
        id: cloudflare-hec-source
        type: cloudflare_hec
        host: 0.0.0.0
        port: 8088
        hecAPI: /services/collector
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Cloudflare HEC
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesConfluentCloud:
      summary: Confluent Cloud
      value:
        id: confluent-cloud-source
        type: confluent_cloud
        brokers:
          - pkc-xxxxx.us-east-1.aws.confluent.cloud:9092
        topics:
          - logs
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Confluent Cloud
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesCollection:
      summary: Collection
      value:
        id: collection-source
        type: collection
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Collection Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesCribl:
      summary: Cribl Internal
      value:
        id: cribl-source
        type: cribl
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Cribl Internal
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesCriblHttp:
      summary: Cribl HTTP
      value:
        id: cribl-http-source
        type: cribl_http
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Cribl HTTP Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesCriblLakeHttp:
      summary: Cribl Lake HTTP
      value:
        id: cribl-lake-http-source
        type: cribl_lake_http
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Cribl Lake HTTP
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesCriblMetrics:
      summary: Cribl Metrics
      value:
        id: cribl-metrics-source
        type: criblmetrics
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Cribl Metrics
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesCriblTcp:
      summary: Cribl TCP
      value:
        id: cribl-tcp-source
        type: cribl_tcp
        host: 0.0.0.0
        port: 10090
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Cribl TCP Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesCrowdstrike:
      summary: CrowdStrike FDR
      value:
        id: crowdstrike-source
        type: crowdstrike
        queueName: crowdstrike-queue
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a CrowdStrike FDR
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesDatadogAgent:
      summary: Datadog Agent
      value:
        id: datadog-agent-source
        type: datadog_agent
        host: 0.0.0.0
        port: 8126
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Datadog Agent
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesDatagen:
      summary: Datagen
      value:
        id: datagen-source
        type: datagen
        samples:
          - sample: sample.json
            eventsPerSec: 10
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Datagen Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesEdgePrometheus:
      summary: Edge Prometheus
      value:
        id: edge-prometheus-source
        type: edge_prometheus
        interval: 60
        discoveryType: static
        targets:
          - host: localhost
            scrapeProtocol: http
            scrapePort: 9090
            scrapePath: /metrics
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Edge Prometheus
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesElastic:
      summary: Elasticsearch
      value:
        id: elastic-source
        type: elastic
        host: localhost
        port: 9200
        elasticAPI: /
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Elasticsearch
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesEventhub:
      summary: Event Hubs
      value:
        id: eventhub-source
        type: eventhub
        brokers:
          - myeventhub.servicebus.windows.net:9093
        topics:
          - logs
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Event Hubs Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesEventhubAmqp:
      summary: Event Hubs AMQP
      value:
        id: eventhub-amqp-source
        type: eventhub_amqp
        eventHubName: my-event-hub
        consumerGroup: $Default
        checkpointing:
          blobStore:
            containerName: my-container
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Event Hubs AMQP
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesExec:
      summary: Exec
      value:
        id: exec-source
        type: exec
        command: echo "Hello World"
        interval: 60
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Exec Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesFile:
      summary: File Monitor
      value:
        id: file-source
        type: file
        mode: manual
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a File Monitor
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesFirehose:
      summary: Firehose
      value:
        id: firehose-source
        type: firehose
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Firehose Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesGrafana:
      summary: Grafana
      value:
        id: grafana-source
        type: grafana
        host: 0.0.0.0
        port: 10080
        prometheusAPI: /api/prom/push
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Grafana Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesGooglePubsub:
      summary: Google Pub/Sub
      value:
        id: google-pubsub-source
        type: google_pubsub
        subscriptionName: my-subscription
        topicName: my-topic
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Google Pub/Sub
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesHttp:
      summary: HTTP
      value:
        id: http-source
        type: http
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a HTTP Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesHttpRaw:
      summary: HTTP Raw
      value:
        id: http-raw-source
        type: http_raw
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a HTTP Raw Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesJournalFiles:
      summary: Journal Files
      value:
        id: journal-files-source
        type: journal_files
        path: /var/log/journal
        journals:
          - system
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Journal Files
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesKafka:
      summary: Kafka
      value:
        id: kafka-source
        type: kafka
        brokers:
          - localhost:9092
        topics:
          - logs
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Kafka Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesKinesis:
      summary: Kinesis
      value:
        id: kinesis-source
        type: kinesis
        streamName: my-stream
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Kinesis Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesKubeEvents:
      summary: Kubernetes Events
      value:
        id: kube-events-source
        type: kube_events
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Kubernetes Events
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesKubeLogs:
      summary: Kubernetes Logs
      value:
        id: kube-logs-source
        type: kube_logs
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Kubernetes Logs
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesKubeMetrics:
      summary: Kubernetes Metrics
      value:
        id: kube-metrics-source
        type: kube_metrics
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Kubernetes Metrics
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesLoki:
      summary: Loki
      value:
        id: loki-source
        type: loki
        host: 0.0.0.0
        port: 10080
        lokiAPI: /loki/api/v1/push
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Loki Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesMetrics:
      summary: Metrics
      value:
        id: metrics-source
        type: metrics
        host: 0.0.0.0
        udpPort: 8125
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Metrics Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesModelDrivenTelemetry:
      summary: Model Driven Telemetry
      value:
        id: mdt-source
        type: model_driven_telemetry
        host: 0.0.0.0
        port: 57000
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Model Driven Telemetry
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesMsk:
      summary: MSK
      value:
        id: msk-source
        type: msk
        brokers:
          - b-1.example.xxxxx.c2.kafka.us-east-1.amazonaws.com:9092
        topics:
          - logs
        region: us-east-1
        awsAuthenticationMethod: auto
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a MSK Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesNetflow:
      summary: Netflow
      value:
        id: netflow-source
        type: netflow
        host: 0.0.0.0
        port: 2055
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Netflow Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesOffice365Mgmt:
      summary: Microsoft 365 Management Activity
      value:
        id: office365-mgmt-source
        type: office365_mgmt
        tenantId: tenant-id
        appId: app-id
        planType: enterprise_gcc
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Microsoft 365 Management
        Activity Source.<br/><br/>The request body must include a complete
        representation of the Source that you want to update. This endpoint does
        not support partial updates.
    UpdateInputExamplesMicrosoftGraph:
      summary: Microsoft Graph
      value:
        id: microsoft-graph-source
        type: microsoft_graph
        url: https://graph.microsoft.com/v1.0/admin/exchange/tracing/messageTraces
        interval: 15
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Microsoft Graph
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesOffice365MsgTrace:
      summary: Microsoft 365 Message Trace
      value:
        id: office365-msg-trace-source
        type: office365_msg_trace
        url: https://reports.office365.com/ecp/reportingwebservice/reporting.svc/MessageTrace
        interval: 15
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Microsoft 365 Message Trace
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesOffice365Service:
      summary: Microsoft 365 Services
      value:
        id: office365-service-source
        type: office365_service
        tenantId: tenant-id
        appId: app-id
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Microsoft 365 Services
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesOkta:
      summary: Okta
      value:
        id: okta-source
        type: okta
        textSecret: okta-api-token-secret
        oktaDomain: your-org
        cronSchedule: "*/5 * * * *"
        earliest: -7d@d
        latest: now
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Okta Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesOpenAI:
      summary: OpenAI
      value:
        id: openai-source
        type: openai
        textSecret: openai-api-key-secret
        contentConfig:
          - contentType: Audit Logs
            contentDescription: Get organization audit logs.
            collectPath: /v1/organization/audit_logs
            requestParams:
              - name: effective_at[gt]
                value: "`${Math.round(Date.now()/1000 - 3600)}`"
              - name: limit
                value: "100"
            paginationType: response_body
            paginationAttribute:
              - last_id
            paginationLastPageExpr: has_more === false
            cronSchedule: 0 * * * *
            earliest: -1h
            latest: now
            disabled: false
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a OpenAI Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesOpenAIComplianceLogs:
      summary: OpenAI Compliance Logs
      value:
        id: openai-compliance-logs-source
        type: openai_compliance_logs
        textSecret: openai-api-key-secret
        accountType: workspace
        workspaceId: aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
        workspaceEventTypes:
          - AUDIT_LOG
          - AUTH_LOG
        cronSchedule: "*/15 * * * *"
        earliest: -1h
        latest: now
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a OpenAI Compliance Logs
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesOpenTelemetry:
      summary: OpenTelemetry
      value:
        id: otel-source
        type: open_telemetry
        host: 0.0.0.0
        port: 4317
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a OpenTelemetry
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesPrometheus:
      summary: Prometheus Scraper
      value:
        id: prometheus-source
        type: prometheus
        interval: 60
        logLevel: info
        discoveryType: static
        targetList:
          - http://localhost:9090/metrics
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Prometheus Scraper
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesPrometheusRw:
      summary: Prometheus Remote Write
      value:
        id: prometheus-rw-source
        type: prometheus_rw
        host: 0.0.0.0
        port: 10080
        prometheusAPI: /write
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Prometheus Remote Write
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesRawUdp:
      summary: Raw UDP
      value:
        id: raw-udp-source
        type: raw_udp
        host: 0.0.0.0
        port: 514
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Raw UDP Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesS3:
      summary: S3
      value:
        id: s3-source
        type: s3
        queueName: s3-notifications-queue
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a S3 Source.<br/><br/>The request
        body must include a complete representation of the Source that you want
        to update. This endpoint does not support partial updates.
    UpdateInputExamplesS3Inventory:
      summary: S3 Inventory
      value:
        id: s3-inventory-source
        type: s3_inventory
        queueName: s3-inventory-queue
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a S3 Inventory
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesSecurityLake:
      summary: Security Lake
      value:
        id: security-lake-source
        type: security_lake
        queueName: security-lake-queue
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Security Lake
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesServiceNowTable:
      summary: ServiceNow Table API
      value:
        id: servicenow-table-source
        type: servicenow_table
        instance: https://example.service-now.com
        tableName: incident
        fields:
          - sys_id
          - number
          - short_description
        pageSize: 10000
        cronSchedule: 0 * * * *
        earliest: -1d
        latest: now
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a ServiceNow Table API
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesSnmp:
      summary: SNMP
      value:
        id: snmp-source
        type: snmp
        host: 192.168.1.1
        port: 161
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a SNMP Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesSplunk:
      summary: Splunk TCP
      value:
        id: splunk-source
        type: splunk
        host: 0.0.0.0
        port: 9997
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Splunk TCP Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesSplunkHec:
      summary: Splunk HEC
      value:
        id: splunk-hec-source
        type: splunk_hec
        host: 0.0.0.0
        port: 8088
        splunkHecAPI: /services/collector
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Splunk HEC Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesSplunkSearch:
      summary: Splunk Search
      value:
        id: splunk-search-source
        type: splunk_search
        authType: basic
        searchHead: https://localhost:8089
        search: index=main
        cronSchedule: "*/15 * * * *"
        endpoint: /services/search/v2/jobs/export
        outputMode: json
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Splunk Search
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesSqs:
      summary: SQS
      value:
        id: sqs-source
        type: sqs
        queueName: my-queue
        queueType: standard
        region: us-east-1
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a SQS Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesSyslog:
      summary: Syslog
      value:
        id: syslog-source
        type: syslog
        host: 0.0.0.0
        udpPort: 514
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Syslog Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesSystemMetrics:
      summary: System Metrics
      value:
        id: system-metrics-source
        type: system_metrics
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a System Metrics
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesSystemState:
      summary: System State
      value:
        id: system-state-source
        type: system_state
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a System State
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesTcp:
      summary: TCP
      value:
        id: tcp-source
        type: tcp
        host: 0.0.0.0
        port: 10090
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a TCP Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesTcpjson:
      summary: TCP JSON
      value:
        id: tcpjson-source
        type: tcpjson
        host: 0.0.0.0
        port: 10090
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a TCP JSON Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesWef:
      summary: Windows Event Forwarder
      value:
        id: wef-source
        type: wef
        host: 0.0.0.0
        port: 5985
        privKeyPath: /path/to/private.key
        certPath: /path/to/certificate.crt
        caPath: /path/to/ca.crt
        subscriptions:
          - subscriptionName: subscription-1
            contentFormat: RenderedText
            heartbeatInterval: 60
            batchTimeout: 5
            targets: []
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Windows Event Forwarder
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesWinEventLogs:
      summary: Windows Event Logs
      value:
        id: win-event-logs-source
        type: win_event_logs
        logNames:
          - Application
          - System
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Windows Event Logs
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesWindowsMetrics:
      summary: Windows Metrics
      value:
        id: windows-metrics-source
        type: windows_metrics
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Windows Metrics
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesWiz:
      summary: Wiz API
      value:
        id: wiz-source
        type: wiz
        endpoint: https://api.wiz.io
        authUrl: https://auth.wiz.io/oauth/token
        clientId: client-id
        contentConfig: []
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Wiz API Source.<br/><br/>The
        request body must include a complete representation of the Source that
        you want to update. This endpoint does not support partial updates.
    UpdateInputExamplesWizWebhook:
      summary: Wiz Webhook
      value:
        id: wiz-webhook-source
        type: wiz_webhook
        host: 0.0.0.0
        port: 10080
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Wiz Webhook
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    UpdateInputExamplesZscalerHec:
      summary: Zscaler Cloud NSS
      value:
        id: zscaler-hec-source
        type: zscaler_hec
        host: 0.0.0.0
        port: 8088
        hecAPI: /services/collector
        sendToRoutes: true
        pqEnabled: false
      description: Example request body for updating a Zscaler Cloud NSS
        Source.<br/><br/>The request body must include a complete representation
        of the Source that you want to update. This endpoint does not support
        partial updates.
    OutputCreateExamplesTcpjson:
      summary: TCP JSON
      value:
        id: tcpjson-output
        type: tcpjson
        host: localhost
        port: 10090
    OutputCreateExamplesSplunk:
      summary: Splunk
      value:
        id: splunk-output
        type: splunk
        host: localhost
        port: 9997
    OutputCreateExamplesSplunkLb:
      summary: Splunk Load Balanced
      value:
        id: splunk-lb-output
        type: splunk_lb
        hosts:
          - host: localhost
            port: 9997
    OutputCreateExamplesSplunkHec:
      summary: Splunk HEC
      value:
        id: splunk-hec-output
        type: splunk_hec
        host: localhost
        port: 8088
        hecToken: your-hec-token
    OutputCreateExamplesSyslog:
      summary: Syslog
      value:
        id: syslog-output
        type: syslog
        host: localhost
        port: 514
    OutputCreateExamplesFilesystem:
      summary: Filesystem
      value:
        id: filesystem-output
        type: filesystem
        destPath: /var/log/output
    OutputCreateExamplesS3:
      summary: S3
      value:
        id: s3-output
        type: s3
        bucket: my-bucket
        region: us-east-1
        stagePath: /tmp/staging
    OutputCreateExamplesNutanixObjects:
      summary: Nutanix Objects
      value:
        id: nutanix-objects-output
        type: nutanix_objects
        bucket: my-bucket
        endpoint: https://nutanix-objects.example.com
        stagePath: /tmp/staging
    OutputCreateExamplesStorjS3:
      summary: Storj
      value:
        id: storj-s3-output
        type: storj_s3
        bucket: my-bucket
        endpoint: https://gateway.storjshare.io
        stagePath: /tmp/staging
    OutputCreateExamplesAlphasocS3:
      summary: AlphaSOC
      value:
        id: alphasoc-s3-output
        type: alphasoc_s3
        bucket: events
        endpoint: https://s3.alphasoc.net
        stagePath: /tmp/staging
    OutputCreateExamplesdellS3:
      summary: Dell PowerScale OneFS
      value:
        id: dell-s3-output
        type: dell_s3
        bucket: my-bucket
        endpoint: https://powerscale.example.com:9021
        stagePath: /tmp/staging
    OutputCreateExamplescloudianS3:
      summary: Cloudian
      value:
        id: cloudian-s3-output
        type: cloudian_s3
        bucket: my-bucket
        endpoint: https://s3.hyperstore.example.com
        stagePath: /tmp/staging
    OutputCreateExamplesscalityS3:
      summary: Scality
      value:
        id: scality-s3-output
        type: scality_s3
        bucket: my-bucket
        endpoint: https://s3.scality.example.com
        stagePath: /tmp/staging
    OutputCreateExamplesalibabaCloudS3:
      summary: Alibaba OSS
      value:
        id: alibaba-oss-output
        type: alibaba_cloud_s3
        bucket: my-bucket
        endpoint: https://s3.oss-cn-hangzhou.aliyuncs.com
        stagePath: /tmp/staging
    OutputCreateExamplesAzureBlob:
      summary: Azure Blob
      value:
        id: azure-blob-output
        type: azure_blob
        containerName: my-container
        stagePath: /tmp/staging
    OutputCreateExamplesAzureDataExplorer:
      summary: Azure Data Explorer
      value:
        id: azure-data-explorer-output
        type: azure_data_explorer
        clusterUrl: https://mycluster.kusto.windows.net
        database: mydatabase
        table: mytable
        oauthEndpoint: https://login.microsoftonline.com
        tenantId: tenant-id
        clientId: client-id
        scope: https://mycluster.kusto.windows.net/.default
        oauthType: clientSecret
        clientSecret: client-secret
        ingestMode: streaming
        format: json
        compress: gzip
    OutputCreateExamplesSentinel:
      summary: Azure Sentinel
      value:
        id: sentinel-output
        type: sentinel
        endpointURLConfiguration: url
        url: https://your-workspace.ingest.monitor.azure.com
        loginUrl: https://login.microsoftonline.com
        secret: client-secret
        client_id: client-id
    OutputCreateExamplesAzureLogs:
      summary: Azure Logs
      value:
        id: azure-logs-output
        type: azure_logs
        workspaceId: workspace-id
        workspaceKey: workspace-key
        logType: Cribl
        authType: manual
    OutputCreateExamplesKafka:
      summary: Kafka
      value:
        id: kafka-output
        type: kafka
        brokers:
          - localhost:9092
        topic: logs
    OutputCreateExamplesConfluentCloud:
      summary: Confluent Cloud
      value:
        id: confluent-cloud-output
        type: confluent_cloud
        brokers:
          - pkc-xxxxx.us-east-1.aws.confluent.cloud:9092
        topic: logs
    OutputCreateExamplesMsk:
      summary: MSK
      value:
        id: msk-output
        type: msk
        brokers:
          - b-1.example.xxxxx.c2.kafka.us-east-1.amazonaws.com:9092
        topic: logs
        region: us-east-1
        awsAuthenticationMethod: auto
    OutputCreateExamplesKinesis:
      summary: Kinesis
      value:
        id: kinesis-output
        type: kinesis
        streamName: my-stream
        region: us-east-1
    OutputCreateExamplesElastic:
      summary: Elasticsearch
      value:
        id: elastic-output
        type: elastic
        host: localhost
        port: 9200
        index: logs
    OutputCreateExamplesElasticCloud:
      summary: Elastic Cloud
      value:
        id: elastic-cloud-output
        type: elastic_cloud
        url: my-cloud-id
        index: logs
    OutputCreateExamplesMicrosoftFabric:
      summary: Microsoft Fabric
      value:
        id: microsoft-fabric-output
        type: microsoft_fabric
        bootstrap_server: myeventstream.servicebus.windows.net:9093
        topic: logs
    OutputCreateExamplesCloudflareR2:
      summary: Cloudflare R2
      value:
        id: cloudflare-r2-output
        type: cloudflare_r2
        bucket: my-bucket
        endpoint: https://account-id.r2.cloudflarestorage.com
        stagePath: /tmp/staging
    OutputCreateExamplesHoneycomb:
      summary: Honeycomb
      value:
        id: honeycomb-output
        type: honeycomb
        apiKey: your-api-key
        dataset: my-dataset
    OutputCreateExamplesNewrelic:
      summary: New Relic
      value:
        id: newrelic-output
        type: newrelic
        apiKey: your-api-key
        baseUrl: https://insights-collector.newrelic.com
    OutputCreateExamplesNewrelicEvents:
      summary: New Relic Events
      value:
        id: newrelic-events-output
        type: newrelic_events
        accountId: "123456"
        eventType: CriblEvent
        apiKey: your-api-key
        baseUrl: https://insights-collector.newrelic.com
    OutputCreateExamplesSnmp:
      summary: SNMP
      value:
        id: snmp-output
        type: snmp
        hosts:
          - host: 192.168.1.1
            port: 161
    OutputCreateExamplesInfluxdb:
      summary: InfluxDB
      value:
        id: influxdb-output
        type: influxdb
        url: http://localhost:8086
        database: mydb
    OutputCreateExamplesMinio:
      summary: MinIO
      value:
        id: minio-output
        type: minio
        bucket: my-bucket
        stagePath: /tmp/staging
        endpoint: http://localhost:9000
    OutputCreateExamplesCloudwatch:
      summary: CloudWatch
      value:
        id: cloudwatch-output
        type: cloudwatch
        logGroupName: my-log-group
        logStreamName: my-log-stream
        region: us-east-1
    OutputCreateExamplesAzureEventhub:
      summary: Azure Event Hub
      value:
        id: azure-eventhub-output
        type: azure_eventhub
        brokers:
          - myeventhub.servicebus.windows.net:9093
        topic: logs
    OutputCreateExamplesStatsd:
      summary: StatsD
      value:
        id: statsd-output
        type: statsd
        protocol: udp
        host: localhost
        port: 8125
    OutputCreateExamplesStatsdExt:
      summary: StatsD Extended
      value:
        id: statsd-ext-output
        type: statsd_ext
        protocol: udp
        host: localhost
        port: 8125
    OutputCreateExamplesGraphite:
      summary: Graphite
      value:
        id: graphite-output
        type: graphite
        protocol: tcp
        host: localhost
        port: 2003
    OutputCreateExamplesWavefront:
      summary: Wavefront
      value:
        id: wavefront-output
        type: wavefront
        domain: longboard
        endpoint: https://your-instance.wavefront.com
        token: your-token
    OutputCreateExamplesSignalfx:
      summary: SignalFx
      value:
        id: signalfx-output
        type: signalfx
        realm: us0
        endpoint: https://ingest.signalfx.com
        token: your-token
    OutputCreateExamplesSqs:
      summary: SQS
      value:
        id: sqs-output
        type: sqs
        queueName: my-queue
        queueType: standard
        region: us-east-1
    OutputCreateExamplesGoogleCloudStorage:
      summary: Google Cloud Storage
      value:
        id: google-cloud-storage-output
        type: google_cloud_storage
        bucket: my-bucket
        endpoint: https://storage.googleapis.com
        region: us-east1
        stagePath: /tmp/staging
        projectId: my-project
    OutputCreateExamplesSumoLogic:
      summary: Sumo Logic
      value:
        id: sumo-logic-output
        type: sumo_logic
        url: https://endpoint1.collection.us2.sumologic.com
        sourceCategory: logs
    OutputCreateExamplesDatadog:
      summary: Datadog
      value:
        id: datadog-output
        type: datadog
        endpoint: https://http-intake.logs.datadoghq.com
        apiKey: your-api-key
    OutputCreateExamplesWebhook:
      summary: Webhook
      value:
        id: webhook-output
        type: webhook
        url: https://example.com/webhook
    OutputCreateExamplesPrometheus:
      summary: Prometheus
      value:
        id: prometheus-output
        type: prometheus
        url: http://localhost:9091/api/v1/write
    OutputCreateExamplesGooglePubsub:
      summary: Google Pub/Sub
      value:
        id: google-pubsub-output
        type: google_pubsub
        projectId: my-project
        topicName: my-topic
    OutputCreateExamplesGoogleChronicle:
      summary: Google Chronicle
      value:
        id: google-chronicle-output
        type: google_chronicle
        logFormatType: unstructured
        region: us
        customerId: customer-id
    OutputCreateExamplesChronicle:
      summary: Chronicle
      value:
        id: chronicle-output
        type: chronicle
        gcpProjectId: my-project
        gcpInstance: customer-id
        region: us
        logType: UNKNOWN
    OutputCreateExamplesGrafanaCloud:
      summary: Grafana Cloud
      value:
        id: grafana-cloud-output
        type: grafana_cloud
        lokiUrl: https://logs-prod-us-central1.grafana.net
    OutputCreateExamplesLoki:
      summary: Loki
      value:
        id: loki-output
        type: loki
        url: http://localhost:3100/loki/api/v1/push
    OutputCreateExamplesOpenTelemetry:
      summary: OpenTelemetry
      value:
        id: opentelemetry-output
        type: open_telemetry
        endpoint: http://localhost:4317
    OutputCreateExamplesServiceNow:
      summary: ServiceNow
      value:
        id: servicenow-output
        type: service_now
        endpoint: ingest.lightstep.com:443
        protocol: http
        otlpVersion: 1.3.1
        tokenSecret: your-token-secret
    OutputCreateExamplesDynatraceOtlp:
      summary: Dynatrace OTLP
      value:
        id: dynatrace-otlp-output
        type: dynatrace_otlp
        endpoint: https://your-environment.live.dynatrace.com/api/v2/otlp
        endpointType: saas
        protocol: http
        otlpVersion: 1.3.1
        tokenSecret: your-token-secret
    OutputCreateExamplesGoogleCloudObservability:
      summary: Google Cloud Observability
      value:
        id: google-cloud-observability-output
        type: google_cloud_observability
        googleAuthMethod: auto
    OutputCreateExamplesSentinelOneAiSiem:
      summary: SentinelOne AI SIEM
      value:
        id: sentinel-one-ai-siem-output
        type: sentinel_one_ai_siem
        region: US
        endpoint: /services/collector/event
    OutputCreateExamplesDataset:
      summary: Dataset
      value:
        id: dataset-output
        type: dataset
        dataset: my-dataset
    OutputCreateExamplesRing:
      summary: Ring Buffer
      value:
        id: ring-output
        type: ring
    OutputCreateExamplesRouter:
      summary: Output Router
      value:
        id: router-output
        type: router
        rules:
          - filter: "true"
            output: my-output
    OutputCreateExamplesWizHec:
      summary: Wiz Defend
      value:
        id: wiz-hec-output
        type: wiz_hec
        data_center: us1
        wiz_sourcetype: placeholder
        wiz_connector_id: 00000000-0000-0000-0000-000000000000
        wiz_environment: test
        authType: manual
        hecToken: your-hec-token
    OutputCreateExamplesHumioHec:
      summary: Humio HEC
      value:
        id: humio-hec-output
        type: humio_hec
        url: https://cloud.us.humio.com/api/v1/ingest/hec
        format: JSON
        authType: manual
        token: your-token
    OutputCreateExamplesCrowdstrikeNextGenSiem:
      summary: CrowdStrike Next Gen SIEM
      value:
        id: crowdstrike-next-gen-siem-output
        type: crowdstrike_next_gen_siem
        url: https://ingest.us.crowdstrike.com/api/ingest/hec/connection-id/v1/services/collector
        format: JSON
        authType: manual
        token: your-token
    OutputCreateExamplesCriblHttp:
      summary: Cribl HTTP
      value:
        id: cribl-http-output
        type: cribl_http
        host: localhost
        port: 10080
    OutputCreateExamplesCriblTcp:
      summary: Cribl TCP
      value:
        id: cribl-tcp-output
        type: cribl_tcp
        host: localhost
        port: 10090
    OutputCreateExamplesCriblSearchEngine:
      summary: Cribl Search Engine
      value:
        id: cribl-search-engine-output
        systemFields:
          - cribl_pipe
        streamtags: []
        loadBalanced: false
        tls:
          disabled: true
        tokenTTLMinutes: 60
        excludeFields:
          - __kube_*
          - __metadata
          - __winEvent
        compression: gzip
        concurrency: 5
        maxPayloadSizeKB: 4096
        maxPayloadEvents: 0
        rejectUnauthorized: true
        timeoutSec: 30
        flushPeriodSec: 1
        failedRequestLoggingMode: none
        safeHeaders: []
        throttleRatePerSec: "0"
        responseRetrySettings:
          - httpStatus: 401
            initialBackoff: 1000
            backoffRate: 2
            maxBackoff: 20000
          - httpStatus: 403
            initialBackoff: 1000
            backoffRate: 2
            maxBackoff: 20000
          - httpStatus: 408
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 429
            initialBackoff: 1000
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 500
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 502
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 503
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 504
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 509
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
        timeoutRetrySettings:
          timeoutRetry: false
        responseHonorRetryAfterHeader: true
        onBackpressure: block
        useRoundRobinDns: true
        type: cribl_search_engine
        url: https://0.0.0.0:10200
    OutputCreateExamplesGoogleCloudLogging:
      summary: Google Cloud Logging
      value:
        id: google-cloud-logging-output
        type: google_cloud_logging
        logLocationType: project
        logLocationExpression: my-project
        logNameExpression: my-log
        projectId: my-project
    OutputCreateExamplesSns:
      summary: SNS
      value:
        id: sns-output
        type: sns
        topicArn: arn:aws:sns:us-east-1:123456789012:my-topic
        messageGroupId: my-message-group
        region: us-east-1
    OutputCreateExamplesDlS3:
      summary: Data Lake S3
      value:
        id: dl-s3-output
        type: dl_s3
        bucket: my-bucket
        stagePath: /tmp/staging
        region: us-east-1
    OutputCreateExamplesSecurityLake:
      summary: Security Lake
      value:
        id: security-lake-output
        type: security_lake
        bucket: my-bucket
        stagePath: /tmp/staging
        region: us-east-1
        accountId: "123456789012"
        customSource: my-custom-source
        assumeRoleArn: arn:aws:iam::123456789012:role/my-role
    OutputCreateExamplesCriblLake:
      summary: Cribl Lake
      value:
        id: cribl-lake-output
        type: cribl_lake
        dataset: my-dataset
    OutputCreateExamplesExabeam:
      summary: Exabeam
      value:
        id: exabeam-output
        type: exabeam
        bucket: my-bucket
        region: us-east1
        endpoint: https://storage.googleapis.com
        stagePath: /tmp/staging
        collectorInstanceId: 11112222-3333-4444-5555-666677778888
    OutputCreateExamplesDiskSpool:
      summary: Disk Spool
      value:
        id: disk-spool-output
        type: disk_spool
        path: /var/spool/cribl
    OutputCreateExamplesClickHouse:
      summary: ClickHouse
      value:
        id: clickhouse-output
        type: click_house
        url: http://localhost:8123/
        database: mydb
        tableName: mytable
    OutputCreateExamplesLocalSearchStorage:
      summary: Local Search Storage
      value:
        id: local-search-storage-output
        type: local_search_storage
        url: http://localhost:8123/
        database: default
        tableName: mytable
    OutputCreateExamplesXsiam:
      summary: XSIAM
      value:
        id: xsiam-output
        type: xsiam
        endpoint: https://api.paloaltonetworks.com
        apiKey: your-api-key
    OutputCreateExamplesNetflow:
      summary: Netflow
      value:
        id: netflow-output
        type: netflow
        hosts:
          - host: localhost
            port: 2055
    OutputCreateExamplesDynatraceHttp:
      summary: Dynatrace HTTP
      value:
        id: dynatrace-http-output
        type: dynatrace_http
        format: json_array
        endpoint: cloud
        telemetryType: logs
        authType: token
        token: your-api-key
    OutputCreateExamplesDatabricks:
      summary: Databricks
      value:
        id: databricks-output
        type: databricks
        workspaceId: your-workspace-id
        scope: all-apis
        clientId: your-client-id
        clientTextSecret: your-client-secret
        catalog: main
        schema: external
        eventsVolumeName: events
    OutputTestExamplesSingleEvent:
      summary: Send a single test event
      description: Example request body for sending a single test event to the Destination.
      value:
        events:
          - _raw: This is a test event
            source: test
            sourcetype: manual
    OutputTestExamplesMultipleEvents:
      summary: Send multiple test events
      description: Example request body for sending multiple test events to the Destination.
      value:
        events:
          - _raw: Test event 1
            source: test
            sourcetype: manual
          - _raw: Test event 2
            source: test
            sourcetype: manual
    UpdateOutputExamplesDefault:
      summary: Default
      value:
        id: default-output
        type: default
        defaultId: my-default-output
      description: Example request body for updating a Default
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesTcpjson:
      summary: TCP JSON
      value:
        id: tcpjson-output
        type: tcpjson
        host: localhost
        port: 10090
      description: Example request body for updating a TCP JSON
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSplunk:
      summary: Splunk
      value:
        id: splunk-output
        type: splunk
        host: localhost
        port: 9997
      description: Example request body for updating a Splunk
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSplunkLb:
      summary: Splunk Load Balanced
      value:
        id: splunk-lb-output
        type: splunk_lb
        hosts:
          - host: localhost
            port: 9997
      description: Example request body for updating a Splunk Load Balanced
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSplunkHec:
      summary: Splunk HEC
      value:
        id: splunk-hec-output
        type: splunk_hec
        host: localhost
        port: 8088
        hecToken: your-hec-token
      description: Example request body for updating a Splunk HEC
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSyslog:
      summary: Syslog
      value:
        id: syslog-output
        type: syslog
        host: localhost
        port: 514
      description: Example request body for updating a Syslog
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesFilesystem:
      summary: Filesystem
      value:
        id: filesystem-output
        type: filesystem
        destPath: /var/log/output
      description: Example request body for updating a Filesystem
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesS3:
      summary: S3
      value:
        id: s3-output
        type: s3
        bucket: my-bucket
        region: us-east-1
        stagePath: /tmp/staging
      description: Example request body for updating a S3 Destination.<br/><br/>The
        request body must include a complete representation of the Destination
        that you want to update. This endpoint does not support partial updates.
    UpdateOutputExamplesNutanixObjects:
      summary: Nutanix Objects
      value:
        id: nutanix-objects-output
        type: nutanix_objects
        bucket: my-bucket
        endpoint: https://nutanix-objects.example.com
        stagePath: /tmp/staging
      description: Example request body for updating a Nutanix Objects
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesStorjS3:
      summary: Storj
      value:
        id: storj-s3-output
        type: storj_s3
        bucket: my-bucket
        endpoint: https://gateway.storjshare.io
        stagePath: /tmp/staging
      description: Example request body for updating a Storj Destination.<br/><br/>The
        request body must include a complete representation of the Destination
        that you want to update. This endpoint does not support partial updates.
    UpdateOutputExamplesAlphasocS3:
      summary: AlphaSOC
      value:
        id: alphasoc-s3-output
        type: alphasoc_s3
        bucket: events
        endpoint: https://s3.alphasoc.net
        stagePath: /tmp/staging
      description: Example request body for updating a AlphaSOC
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesdellS3:
      summary: Dell PowerScale OneFS
      value:
        id: dell-s3-output
        type: dell_s3
        bucket: my-bucket
        endpoint: https://powerscale.example.com:9021
        stagePath: /tmp/staging
      description: Example request body for updating a Dell PowerScale OneFS
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplescloudianS3:
      summary: Cloudian
      value:
        id: cloudian-s3-output
        type: cloudian_s3
        bucket: my-bucket
        endpoint: https://s3.hyperstore.example.com
        stagePath: /tmp/staging
      description: Example request body for updating a Cloudian
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesscalityS3:
      summary: Scality
      value:
        id: scality-s3-output
        type: scality_s3
        bucket: my-bucket
        endpoint: https://s3.scality.example.com
        stagePath: /tmp/staging
      description: Example request body for updating a Scality
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesalibabaCloudS3:
      summary: Alibaba OSS
      value:
        id: alibaba-oss-output
        type: alibaba_cloud_s3
        bucket: my-bucket
        endpoint: https://s3.oss-cn-hangzhou.aliyuncs.com
        stagePath: /tmp/staging
      description: Example request body for updating a Alibaba OSS
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesAzureBlob:
      summary: Azure Blob
      value:
        id: azure-blob-output
        type: azure_blob
        containerName: my-container
        stagePath: /tmp/staging
      description: Example request body for updating a Azure Blob
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesAzureDataExplorer:
      summary: Azure Data Explorer
      value:
        id: azure-data-explorer-output
        type: azure_data_explorer
        clusterUrl: https://mycluster.kusto.windows.net
        database: mydatabase
        table: mytable
        oauthEndpoint: https://login.microsoftonline.com
        tenantId: tenant-id
        clientId: client-id
        scope: https://mycluster.kusto.windows.net/.default
        oauthType: clientSecret
        clientSecret: client-secret
        ingestMode: streaming
        format: json
        compress: gzip
      description: Example request body for updating a Azure Data Explorer
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSentinel:
      summary: Azure Sentinel
      value:
        id: sentinel-output
        type: sentinel
        endpointURLConfiguration: url
        url: https://your-workspace.ingest.monitor.azure.com
        loginUrl: https://login.microsoftonline.com
        secret: client-secret
        client_id: client-id
      description: Example request body for updating a Azure Sentinel
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesAzureLogs:
      summary: Azure Logs
      value:
        id: azure-logs-output
        type: azure_logs
        workspaceId: workspace-id
        workspaceKey: workspace-key
        logType: Cribl
        authType: manual
      description: Example request body for updating a Azure Logs
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesKafka:
      summary: Kafka
      value:
        id: kafka-output
        type: kafka
        brokers:
          - localhost:9092
        topic: logs
      description: Example request body for updating a Kafka Destination.<br/><br/>The
        request body must include a complete representation of the Destination
        that you want to update. This endpoint does not support partial updates.
    UpdateOutputExamplesConfluentCloud:
      summary: Confluent Cloud
      value:
        id: confluent-cloud-output
        type: confluent_cloud
        brokers:
          - pkc-xxxxx.us-east-1.aws.confluent.cloud:9092
        topic: logs
      description: Example request body for updating a Confluent Cloud
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesMsk:
      summary: MSK
      value:
        id: msk-output
        type: msk
        brokers:
          - b-1.example.xxxxx.c2.kafka.us-east-1.amazonaws.com:9092
        topic: logs
        region: us-east-1
        awsAuthenticationMethod: auto
      description: Example request body for updating a MSK Destination.<br/><br/>The
        request body must include a complete representation of the Destination
        that you want to update. This endpoint does not support partial updates.
    UpdateOutputExamplesKinesis:
      summary: Kinesis
      value:
        id: kinesis-output
        type: kinesis
        streamName: my-stream
        region: us-east-1
      description: Example request body for updating a Kinesis
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesElastic:
      summary: Elasticsearch
      value:
        id: elastic-output
        type: elastic
        host: localhost
        port: 9200
        index: logs
      description: Example request body for updating a Elasticsearch
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesElasticCloud:
      summary: Elastic Cloud
      value:
        id: elastic-cloud-output
        type: elastic_cloud
        url: my-cloud-id
        index: logs
      description: Example request body for updating a Elastic Cloud
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesMicrosoftFabric:
      summary: Microsoft Fabric
      value:
        id: microsoft-fabric-output
        type: microsoft_fabric
        bootstrap_server: myeventstream.servicebus.windows.net:9093
        topic: logs
      description: Example request body for updating a Microsoft Fabric
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesCloudflareR2:
      summary: Cloudflare R2
      value:
        id: cloudflare-r2-output
        type: cloudflare_r2
        bucket: my-bucket
        endpoint: https://account-id.r2.cloudflarestorage.com
        stagePath: /tmp/staging
      description: Example request body for updating a Cloudflare R2
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesHoneycomb:
      summary: Honeycomb
      value:
        id: honeycomb-output
        type: honeycomb
        apiKey: your-api-key
        dataset: my-dataset
      description: Example request body for updating a Honeycomb
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesNewrelic:
      summary: New Relic
      value:
        id: newrelic-output
        type: newrelic
        apiKey: your-api-key
        baseUrl: https://insights-collector.newrelic.com
      description: Example request body for updating a New Relic
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesNewrelicEvents:
      summary: New Relic Events
      value:
        id: newrelic-events-output
        type: newrelic_events
        accountId: "123456"
        eventType: CriblEvent
        apiKey: your-api-key
        baseUrl: https://insights-collector.newrelic.com
      description: Example request body for updating a New Relic Events
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSnmp:
      summary: SNMP
      value:
        id: snmp-output
        type: snmp
        hosts:
          - host: 192.168.1.1
            port: 161
      description: Example request body for updating a SNMP Destination.<br/><br/>The
        request body must include a complete representation of the Destination
        that you want to update. This endpoint does not support partial updates.
    UpdateOutputExamplesInfluxdb:
      summary: InfluxDB
      value:
        id: influxdb-output
        type: influxdb
        url: http://localhost:8086
        database: mydb
      description: Example request body for updating a InfluxDB
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesMinio:
      summary: MinIO
      value:
        id: minio-output
        type: minio
        bucket: my-bucket
        stagePath: /tmp/staging
        endpoint: http://localhost:9000
      description: Example request body for updating a MinIO Destination.<br/><br/>The
        request body must include a complete representation of the Destination
        that you want to update. This endpoint does not support partial updates.
    UpdateOutputExamplesCloudwatch:
      summary: CloudWatch
      value:
        id: cloudwatch-output
        type: cloudwatch
        logGroupName: my-log-group
        logStreamName: my-log-stream
        region: us-east-1
      description: Example request body for updating a CloudWatch
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesAzureEventhub:
      summary: Azure Event Hub
      value:
        id: azure-eventhub-output
        type: azure_eventhub
        brokers:
          - myeventhub.servicebus.windows.net:9093
        topic: logs
      description: Example request body for updating a Azure Event Hub
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesStatsd:
      summary: StatsD
      value:
        id: statsd-output
        type: statsd
        protocol: udp
        host: localhost
        port: 8125
      description: Example request body for updating a StatsD
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesStatsdExt:
      summary: StatsD Extended
      value:
        id: statsd-ext-output
        type: statsd_ext
        protocol: udp
        host: localhost
        port: 8125
      description: Example request body for updating a StatsD Extended
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesGraphite:
      summary: Graphite
      value:
        id: graphite-output
        type: graphite
        protocol: tcp
        host: localhost
        port: 2003
      description: Example request body for updating a Graphite
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesWavefront:
      summary: Wavefront
      value:
        id: wavefront-output
        type: wavefront
        domain: longboard
        endpoint: https://your-instance.wavefront.com
        token: your-token
      description: Example request body for updating a Wavefront
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSignalfx:
      summary: SignalFx
      value:
        id: signalfx-output
        type: signalfx
        realm: us0
        endpoint: https://ingest.signalfx.com
        token: your-token
      description: Example request body for updating a SignalFx
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSqs:
      summary: SQS
      value:
        id: sqs-output
        type: sqs
        queueName: my-queue
        queueType: standard
        region: us-east-1
      description: Example request body for updating a SQS Destination.<br/><br/>The
        request body must include a complete representation of the Destination
        that you want to update. This endpoint does not support partial updates.
    UpdateOutputExamplesGoogleCloudStorage:
      summary: Google Cloud Storage
      value:
        id: google-cloud-storage-output
        type: google_cloud_storage
        bucket: my-bucket
        endpoint: https://storage.googleapis.com
        region: us-east1
        stagePath: /tmp/staging
        projectId: my-project
      description: Example request body for updating a Google Cloud Storage
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSumoLogic:
      summary: Sumo Logic
      value:
        id: sumo-logic-output
        type: sumo_logic
        url: https://endpoint1.collection.us2.sumologic.com
        sourceCategory: logs
      description: Example request body for updating a Sumo Logic
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesDatadog:
      summary: Datadog
      value:
        id: datadog-output
        type: datadog
        endpoint: https://http-intake.logs.datadoghq.com
        apiKey: your-api-key
      description: Example request body for updating a Datadog
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesWebhook:
      summary: Webhook
      value:
        id: webhook-output
        type: webhook
        url: https://example.com/webhook
      description: Example request body for updating a Webhook
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesPrometheus:
      summary: Prometheus
      value:
        id: prometheus-output
        type: prometheus
        url: http://localhost:9091/api/v1/write
      description: Example request body for updating a Prometheus
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesGooglePubsub:
      summary: Google Pub/Sub
      value:
        id: google-pubsub-output
        type: google_pubsub
        projectId: my-project
        topicName: my-topic
      description: Example request body for updating a Google Pub/Sub
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesGoogleChronicle:
      summary: Google Chronicle
      value:
        id: google-chronicle-output
        type: google_chronicle
        logFormatType: unstructured
        region: us
        customerId: customer-id
      description: Example request body for updating a Google Chronicle
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesChronicle:
      summary: Chronicle
      value:
        id: chronicle-output
        type: chronicle
        gcpProjectId: my-project
        gcpInstance: customer-id
        region: us
        logType: UNKNOWN
      description: Example request body for updating a Chronicle
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesGrafanaCloud:
      summary: Grafana Cloud
      value:
        id: grafana-cloud-output
        type: grafana_cloud
        lokiUrl: https://logs-prod-us-central1.grafana.net
      description: Example request body for updating a Grafana Cloud
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesLoki:
      summary: Loki
      value:
        id: loki-output
        type: loki
        url: http://localhost:3100/loki/api/v1/push
      description: Example request body for updating a Loki Destination.<br/><br/>The
        request body must include a complete representation of the Destination
        that you want to update. This endpoint does not support partial updates.
    UpdateOutputExamplesOpenTelemetry:
      summary: OpenTelemetry
      value:
        id: opentelemetry-output
        type: open_telemetry
        endpoint: http://localhost:4317
      description: Example request body for updating a OpenTelemetry
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesServiceNow:
      summary: ServiceNow
      value:
        id: servicenow-output
        type: service_now
        endpoint: ingest.lightstep.com:443
        protocol: http
        otlpVersion: 1.3.1
        tokenSecret: your-token-secret
      description: Example request body for updating a ServiceNow
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesDynatraceOtlp:
      summary: Dynatrace OTLP
      value:
        id: dynatrace-otlp-output
        type: dynatrace_otlp
        endpoint: https://your-environment.live.dynatrace.com/api/v2/otlp
        endpointType: saas
        protocol: http
        otlpVersion: 1.3.1
        tokenSecret: your-token-secret
      description: Example request body for updating a Dynatrace OTLP
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesGoogleCloudObservability:
      summary: Google Cloud Observability
      value:
        id: google-cloud-observability-output
        type: google_cloud_observability
        googleAuthMethod: auto
      description: Example request body for updating a Google Cloud Observability
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSentinelOneAiSiem:
      summary: SentinelOne AI SIEM
      value:
        id: sentinel-one-ai-siem-output
        type: sentinel_one_ai_siem
        region: US
        endpoint: /services/collector/event
      description: Example request body for updating a SentinelOne AI SIEM
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesDataset:
      summary: Dataset
      value:
        id: dataset-output
        type: dataset
        dataset: my-dataset
      description: Example request body for updating a Dataset
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesRing:
      summary: Ring Buffer
      value:
        id: ring-output
        type: ring
      description: Example request body for updating a Ring Buffer
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesRouter:
      summary: Output Router
      value:
        id: router-output
        type: router
        rules:
          - filter: "true"
            output: my-output
      description: Example request body for updating a Output Router
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesWizHec:
      summary: Wiz Defend
      value:
        id: wiz-hec-output
        type: wiz_hec
        data_center: us1
        wiz_sourcetype: placeholder
        wiz_connector_id: 00000000-0000-0000-0000-000000000000
        wiz_environment: test
        authType: manual
        hecToken: your-hec-token
      description: Example request body for updating a Wiz Defend
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesHumioHec:
      summary: Humio HEC
      value:
        id: humio-hec-output
        type: humio_hec
        url: https://cloud.us.humio.com/api/v1/ingest/hec
        format: JSON
        authType: manual
        token: your-token
      description: Example request body for updating a Humio HEC
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesCrowdstrikeNextGenSiem:
      summary: CrowdStrike Next Gen SIEM
      value:
        id: crowdstrike-next-gen-siem-output
        type: crowdstrike_next_gen_siem
        url: https://ingest.us.crowdstrike.com/api/ingest/hec/connection-id/v1/services/collector
        format: JSON
        authType: manual
        token: your-token
      description: Example request body for updating a CrowdStrike Next Gen SIEM
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesCriblHttp:
      summary: Cribl HTTP
      value:
        id: cribl-http-output
        type: cribl_http
        host: localhost
        port: 10080
      description: Example request body for updating a Cribl HTTP
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesCriblTcp:
      summary: Cribl TCP
      value:
        id: cribl-tcp-output
        type: cribl_tcp
        host: localhost
        port: 10090
      description: Example request body for updating a Cribl TCP
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesCriblSearchEngine:
      summary: Cribl Search Engine
      value:
        id: cribl-search-engine-output
        systemFields:
          - cribl_pipe
        streamtags: []
        loadBalanced: false
        tls:
          disabled: true
        tokenTTLMinutes: 60
        excludeFields:
          - __kube_*
          - __metadata
          - __winEvent
        compression: gzip
        concurrency: 5
        maxPayloadSizeKB: 4096
        maxPayloadEvents: 0
        rejectUnauthorized: true
        timeoutSec: 30
        flushPeriodSec: 1
        failedRequestLoggingMode: none
        safeHeaders: []
        throttleRatePerSec: "0"
        responseRetrySettings:
          - httpStatus: 401
            initialBackoff: 1000
            backoffRate: 2
            maxBackoff: 20000
          - httpStatus: 403
            initialBackoff: 1000
            backoffRate: 2
            maxBackoff: 20000
          - httpStatus: 408
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 429
            initialBackoff: 1000
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 500
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 502
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 503
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 504
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
          - httpStatus: 509
            initialBackoff: 250
            backoffRate: 2
            maxBackoff: 10000
        timeoutRetrySettings:
          timeoutRetry: false
        responseHonorRetryAfterHeader: true
        onBackpressure: block
        useRoundRobinDns: true
        type: cribl_search_engine
        url: https://0.0.0.0:10200
      description: Example request body for updating a Cribl Search Engine
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesGoogleCloudLogging:
      summary: Google Cloud Logging
      value:
        id: google-cloud-logging-output
        type: google_cloud_logging
        logLocationType: project
        logLocationExpression: my-project
        logNameExpression: my-log
        projectId: my-project
      description: Example request body for updating a Google Cloud Logging
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSns:
      summary: SNS
      value:
        id: sns-output
        type: sns
        topicArn: arn:aws:sns:us-east-1:123456789012:my-topic
        messageGroupId: my-message-group
        region: us-east-1
      description: Example request body for updating a SNS Destination.<br/><br/>The
        request body must include a complete representation of the Destination
        that you want to update. This endpoint does not support partial updates.
    UpdateOutputExamplesDlS3:
      summary: Data Lake S3
      value:
        id: dl-s3-output
        type: dl_s3
        bucket: my-bucket
        stagePath: /tmp/staging
        region: us-east-1
      description: Example request body for updating a Data Lake S3
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesSecurityLake:
      summary: Security Lake
      value:
        id: security-lake-output
        type: security_lake
        bucket: my-bucket
        stagePath: /tmp/staging
        region: us-east-1
        accountId: "123456789012"
        customSource: my-custom-source
        assumeRoleArn: arn:aws:iam::123456789012:role/my-role
      description: Example request body for updating a Security Lake
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesCriblLake:
      summary: Cribl Lake
      value:
        id: cribl-lake-output
        type: cribl_lake
        dataset: my-dataset
      description: Example request body for updating a Cribl Lake
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesExabeam:
      summary: Exabeam
      value:
        id: exabeam-output
        type: exabeam
        bucket: my-bucket
        region: us-east1
        endpoint: https://storage.googleapis.com
        stagePath: /tmp/staging
        collectorInstanceId: 11112222-3333-4444-5555-666677778888
      description: Example request body for updating a Exabeam
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesDiskSpool:
      summary: Disk Spool
      value:
        id: disk-spool-output
        type: disk_spool
        path: /var/spool/cribl
      description: Example request body for updating a Disk Spool
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesClickHouse:
      summary: ClickHouse
      value:
        id: clickhouse-output
        type: click_house
        url: http://localhost:8123/
        database: mydb
        tableName: mytable
      description: Example request body for updating a ClickHouse
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesLocalSearchStorage:
      summary: Local Search Storage
      value:
        id: local-search-storage-output
        type: local_search_storage
        url: http://localhost:8123/
        database: default
        tableName: mytable
      description: Example request body for updating a Local Search Storage
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesXsiam:
      summary: XSIAM
      value:
        id: xsiam-output
        type: xsiam
        endpoint: https://api.paloaltonetworks.com
        apiKey: your-api-key
      description: Example request body for updating a XSIAM Destination.<br/><br/>The
        request body must include a complete representation of the Destination
        that you want to update. This endpoint does not support partial updates.
    UpdateOutputExamplesNetflow:
      summary: Netflow
      value:
        id: netflow-output
        type: netflow
        hosts:
          - host: localhost
            port: 2055
      description: Example request body for updating a Netflow
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesDynatraceHttp:
      summary: Dynatrace HTTP
      value:
        id: dynatrace-http-output
        type: dynatrace_http
        format: json_array
        endpoint: cloud
        telemetryType: logs
        authType: token
        token: your-api-key
      description: Example request body for updating a Dynatrace HTTP
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    UpdateOutputExamplesDatabricks:
      summary: Databricks
      value:
        id: databricks-output
        type: databricks
        workspaceId: your-workspace-id
        scope: all-apis
        clientId: your-client-id
        clientTextSecret: your-client-secret
        catalog: main
        schema: external
        eventsVolumeName: events
      description: Example request body for updating a Databricks
        Destination.<br/><br/>The request body must include a complete
        representation of the Destination that you want to update. This endpoint
        does not support partial updates.
    ParquetSchemaExamplesEventData:
      summary: Parquet schema for structured event data
      description: Example request body for creating a Parquet schema that defines
        columns for structured event data.
      value:
        id: events-parquet-schema
        description: Parquet schema for structured event data
        schema: '{"schema":[{"name":"timestamp","type":"INT64","logicalType":"TIMESTAMP_MILLIS"},{"name":"source","type":"BYTE_ARRAY","logicalType":"UTF8"},{"name":"message","type":"BYTE_ARRAY","logicalType":"UTF8"},{"name":"severity","type":"INT32"}]}'
    ParquetSchemaExamplesAccessLogs:
      summary: Parquet schema for HTTP access logs
      description: Example request body for creating a Parquet schema that defines
        columns for HTTP access log data.
      value:
        id: access-logs-schema
        description: Parquet schema for HTTP access log data
        schema: '{"schema":[{"name":"timestamp","type":"INT64","logicalType":"TIMESTAMP_MILLIS"},{"name":"method","type":"BYTE_ARRAY","logicalType":"UTF8"},{"name":"path","type":"BYTE_ARRAY","logicalType":"UTF8"},{"name":"status_code","type":"INT32"},{"name":"response_bytes","type":"INT64"}]}'
    PipelineExamplesEmpty:
      summary: New empty Pipeline
      value:
        id: empty-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          functions: []
          description: ""
    PipelineExamplesAggregations:
      summary: Pipeline with aggregation function summing rejected bytes grouped by
        source address
      value:
        id: aggregation-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that aggregates rejected bytes grouped by source address
            every 10 seconds
          functions:
            - id: aggregation
              filter: "true"
              conf:
                passthrough: false
                preserveGroupBys: false
                sufficientStatsOnly: false
                metricsMode: false
                timeWindow: 10s
                aggregations:
                  - sum(bytes).where(action=="REJECT").as(TotalBytes)
                groupbys:
                  - srcaddr
                cumulative: false
                shouldTreatDotsAsLiterals: false
                flushOnInputClose: true
    PipelineExamplesAggregateMetrics:
      summary: Pipeline with aggregate metrics function computing statistics on
        process metrics
      value:
        id: aggregate-metrics-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: "Pipeline that aggregates process metrics: CPU, memory, and bytes
            over time windows"
          functions:
            - id: aggregate_metrics
              filter: (_metric == 'proc.cpu_perc' ||
                __criblMetrics[0].nameExpr.includes("'proc.cpu_perc'")) ||
                (_metric == 'proc.mem_perc' ||
                __criblMetrics[0].nameExpr.includes("'proc.mem_perc'")) ||
                (_metric == 'proc.bytes_in' ||
                __criblMetrics[0].nameExpr.includes("'proc.bytes_in'"))
              conf:
                passthrough: false
                preserveGroupBys: false
                sufficientStatsOnly: false
                timeWindow: 10s
                aggregations:
                  - metricType: gauge
                    agg: avg(_value || proc.cpu_perc).as(proc.cpu_perc_avg)
                  - metricType: gauge
                    agg: sum(_value || proc.mem_perc).as(proc.mem_perc_sum)
                  - metricType: counter
                    agg: count(_value || proc.bytes_in).as(proc.bytes_in_count)
                groupbys:
                  - proc
                cumulative: false
                shouldTreatDotsAsLiterals: true
                flushOnInputClose: true
    PipelineExamplesAutoTimestamp:
      summary: Pipeline with auto timestamp function extracting timestamps from event
        data
      value:
        id: auto-timestamp-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that extracts timestamps from event data using auto
            timestamp function
          functions:
            - id: auto_timestamp
              filter: "true"
              conf:
                srcField: _raw
                dstField: _time
                defaultTimezone: local
                timeExpression: time.getTime() / 1000
                offset: 0
                maxLen: 150
                defaultTime: now
                latestDateAllowed: +1week
                earliestDateAllowed: -420weeks
                timestamps:
                  - regex: /(\d{1,2}\/\d{2}\/\d{4}\s\d{1,2}:\d{2}:\d{2}\s\w{2})/
                    strptime: "%Y-%m-%d %H:%M:%S"
    PipelineExamplesCEFSerializer:
      summary: Pipeline with CEF serializer function formatting events in Common Event
        Format
      value:
        id: cef-serializer-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that formats events in CEF format with custom header and
            extension fields
          functions:
            - id: cef
              filter: "true"
              conf:
                outputField: _raw
                header:
                  - name: cef_version
                    value: "'CEF:0'"
                  - name: device_vendor
                    value: "'Cribl'"
                  - name: device_product
                    value: "'Cribl'"
                  - name: device_version
                    value: C.version
                  - name: device_event_class_id
                    value: "420"
                  - name: name
                    value: "'Cribl Event'"
                  - name: severity
                    value: "6"
                extension:
                  - name: c6a1Label
                    value: "'Colorado_Ext_Bldg7'"
    PipelineExamplesChain:
      summary: Pipeline with chain function connecting to another pipeline for
        sequential processing
      value:
        id: chain-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that chains to another pipeline for sequential data
            processing
          functions:
            - id: chain
              filter: "true"
              conf:
                processor: prometheus_metrics
    PipelineExamplesClone:
      summary: Pipeline with clone function creating copies of events with additional
        fields
      value:
        id: clone-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that creates cloned events with additional fields for
            comparison or routing
          functions:
            - id: clone
              filter: "true"
              conf:
                clones:
                  - env: staging
                  - index: clones
    PipelineExamplesComment:
      summary: Pipeline with comment function adding documentation annotations
      value:
        id: comment-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline with comment function for documentation
          functions:
            - id: comment
              filter: "true"
              conf:
                comment: This function processes security events and enriches them with DNS
                  lookups
    PipelineExamplesDNSLookup:
      summary: Pipeline with DNS lookup function resolving hostnames and IP addresses
      value:
        id: dns-lookup-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that performs DNS lookups to resolve hostnames and IP
            addresses
          functions:
            - id: dns_lookup
              filter: "true"
              conf:
                dnsLookupFields:
                  - inFieldName: hostname
                    resourceRecordType: A
                    outFieldName: hostname_ip
                reverseLookupFields:
                  - inFieldName: src_ip
                    outFieldName: src_hostname
                cacheTTL: 30
                maxCacheSize: 5000
                useResolvConf: false
                lookupFallback: false
                lookupFailLogLevel: error
    PipelineExamplesDrop:
      summary: Pipeline with drop function filtering out events matching specified
        criteria
      value:
        id: drop-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that drops events containing success messages
          functions:
            - id: drop
              filter: _raw.search(/success/i)>=0
              conf: {}
    PipelineExamplesDropDimensions:
      summary: Pipeline with drop dimensions function reducing metric cardinality by
        removing dimensions
      value:
        id: drop-dimensions-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that drops specified dimensions from metrics to reduce
            cardinality
          functions:
            - id: drop_dimensions
              filter: (_metric == 'proc.cpu_perc' ||
                __criblMetrics[0].nameExpr.includes("'proc.cpu_perc'")) &&
                (__criblMetrics[0].dims.includes("proc"))
              conf:
                timeWindow: 10s
                dropDimensions:
                  - proc
                  - pie
                  - unit
                flushOnInputClose: true
    PipelineExamplesDynamicSampling:
      summary: Pipeline with dynamic sampling function automatically adjusting sample
        rates based on event volume
      value:
        id: dynamic-sampling-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that dynamically samples events based on volume using
            square root mode
          functions:
            - id: dynamic_sampling
              filter: "true"
              conf:
                mode: sqrt
                keyExpr: "`${domain}:${httpCode}`"
                samplePeriod: 20
                minEvents: 3
                maxSampleRate: 3
    PipelineExamplesEval:
      summary: Pipeline with eval function adding, modifying, and removing event
        fields using JavaScript expressions
      value:
        id: eval-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that evaluates JavaScript expressions to add, modify, and
            remove fields
          functions:
            - id: eval
              filter: "true"
              conf:
                add:
                  - name: action
                    value: "login == 'error' ? 'blocked' : action"
                  - name: myTags
                    value: "login == 'error' ? [...myTags, 'error'] : myTags"
                keep:
                  - host
                  - source
                  - action
                  - myTags
                remove:
                  - identification
    PipelineExamplesEventBreaker:
      summary: Pipeline with event breaker function splitting large blobs or streams
        into discrete events
      value:
        id: event-breaker-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that breaks large event streams into discrete events using
            regex
          functions:
            - id: event_breaker
              filter: "true"
              conf:
                existingOrNew: new
                ruleType: regex
                eventBreakerRegex: /[\n\r]+(?!\s)/
                maxEventBytes: 51200
                timestampAnchorRegex: /^/
                timestamp:
                  type: auto
                  length: 150
                timestampTimezone: local
                timestampEarliest: -420weeks
                timestampLatest: +1week
                shouldMarkCriblBreaker: true
    PipelineExamplesFlatten:
      summary: Pipeline with flatten function pulling nested fields up to a higher
        level in the object
      value:
        id: flatten-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that flattens nested JSON structures into top-level fields
          functions:
            - id: flatten
              filter: "true"
              conf:
                fields: []
                prefix: ""
                depth: 5
                delimiter: _
    PipelineExamplesFoldKeys:
      summary: Pipeline with fold keys function transforming flat field names into
        nested structures
      value:
        id: fold-keys-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that transforms flat field names with separators into
            nested structures
          functions:
            - id: foldkeys
              filter: "true"
              conf:
                deleteOriginal: true
                separator: _
                selectionRegExp: ^data
    PipelineExamplesGeoIP:
      summary: Pipeline with GeoIP function enriching events with geographic
        information based on IP addresses
      value:
        id: geoip-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that enriches events with geolocation data from IP addresses
          functions:
            - id: geoip
              filter: "true"
              conf:
                file: GeoLite2-City.mmdb
                inField: ip
                outField: geoip
                additionalFields:
                  - extraInField: src_ip
                    extraOutField: src_geoip
    PipelineExamplesGrok:
      summary: Pipeline with grok function extracting structured fields from
        unstructured log data using patterns
      value:
        id: grok-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that extracts structured fields from log data using Grok
            patterns
          functions:
            - id: grok
              filter: "true"
              conf:
                pattern: "%{TIMESTAMP_ISO8601:event_time} %{LOGLEVEL:log_level}
                  %{GREEDYDATA:log_message}"
                source: _raw
                patternList: []
    PipelineExamplesGuard:
      summary: Pipeline with guard function detecting and protecting sensitive data
        using AI-driven scanning rulesets
      value:
        id: guard-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that scans for sensitive data and applies mitigation
            expressions
          functions:
            - id: sensitive_data_scanner
              filter: "true"
              conf:
                rules:
                  - rulesetId: Finance_Global
                    replaceExpr: "'REDACTED'"
                    disabled: false
                fields:
                  - _raw
                excludeFields: []
                flags:
                  - name: _sensitive
                    value: "true"
                includeDetectedRules: true
    PipelineExamplesJSONUnroll:
      summary: Pipeline with JSON unroll function exploding arrays of objects into
        individual events
      value:
        id: json-unroll-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that unrolls JSON arrays into individual events while
            retaining parent fields
          functions:
            - id: json_unroll
              filter: "true"
              conf:
                path: allCars
                name: cars
    PipelineExamplesLookup:
      summary: Pipeline with lookup function enriching events with external fields
        from lookup tables
      value:
        id: lookup-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that enriches events with location data from IP address
            lookups
          functions:
            - id: lookup
              filter: "true"
              conf:
                file: ip_locations.csv
                dbLookup: false
                matchMode: exact
                reloadPeriodSec: -1
                inFields:
                  - eventField: destination_ip
                    lookupField: ip
                outFields:
                  - lookupField: location
                    eventField: location
                    defaultValue: Unknown
                addToEvent: false
                ignoreCase: false
    PipelineExamplesMask:
      summary: Pipeline with mask function redacting sensitive data using pattern
        matching and replacement
      value:
        id: mask-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that masks Social Security numbers and other sensitive data
          functions:
            - id: mask
              filter: "true"
              conf:
                rules:
                  - matchRegex: /(social=)(\d+)/
                    replaceExpr: "`${g1}${C.Mask.md5(g2)}`"
                    disabled: false
                fields:
                  - _raw
                depth: 5
    PipelineExamplesNumerify:
      summary: Pipeline with numerify function converting string numbers to numeric type
      value:
        id: numerify-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that converts string numbers to numeric type for
            mathematical operations
          functions:
            - id: numerify
              filter: "true"
              conf:
                depth: 5
                ignoreFields: []
                filterExpr: ""
                format: none
    PipelineExamplesOTLPLogs:
      summary: Pipeline with OTLP logs function normalizing and batching OpenTelemetry
        log events
      value:
        id: otlp-logs-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that normalizes and batches OTLP log events from
            OpenTelemetry sources
          functions:
            - id: otlp_logs
              filter: __inputId=='open_telemetry:open_telemetry'
              conf:
                dropNonLogEvents: false
                batchOTLPLogs: true
                sendBatchSize: 8192
                timeout: 200
                sendBatchMaxSize: 0
                metadataKeys: []
                metadataCardinalityLimit: 1000
    PipelineExamplesOTLPMetrics:
      summary: Pipeline with OTLP metrics function converting dimensional metrics to
        OpenTelemetry format
      value:
        id: otlp-metrics-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that converts dimensional metrics to OTLP format and
            batches them by resource attributes
          functions:
            - id: otlp_metrics
              filter: __inputId=='prometheus_rw:prom_rw_in'
              conf:
                resourceAttributePrefixes:
                  - service
                  - system
                  - telemetry
                  - k8s
                  - cloud
                  - host
                  - process
                dropNonMetricEvents: false
                otlpVersion: 0.10.0
                batchOTLPMetrics: true
                sendBatchSize: 8192
                timeout: 200
                sendBatchMaxSize: 0
                metadataKeys: []
                metadataCardinalityLimit: 1000
    PipelineExamplesOTLPTraces:
      summary: Pipeline with OTLP traces function normalizing and batching
        OpenTelemetry trace events
      value:
        id: otlp-traces-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that normalizes and batches OTLP trace events from
            OpenTelemetry sources
          functions:
            - id: otlp_traces
              filter: __inputId=='open_telemetry:open_telemetry'
              conf:
                dropNonTraceEvents: false
                otlpVersion: 0.10.0
                batchOTLPTraces: true
                sendBatchSize: 8192
                timeout: 200
                sendBatchMaxSize: 0
                metadataKeys: []
                metadataCardinalityLimit: 1000
    PipelineExamplesParser:
      summary: Pipeline with parser function extracting fields from key-value pairs
      value:
        id: parser-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that extracts fields from key-value pair formatted data
          functions:
            - id: serde
              filter: "true"
              conf:
                mode: extract
                type: kvp
                srcField: _raw
                keep:
                  - a
                  - b
                  - c
                remove:
                  - "*"
                cleanFields: false
    PipelineExamplesPublishMetrics:
      summary: Pipeline with publish metrics function extracting and formatting
        metrics from events
      value:
        id: publish-metrics-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that extracts metrics from events and formats them for
            metrics aggregation platforms
          functions:
            - id: publish_metrics
              filter: "true"
              conf:
                fields:
                  - inFieldName: bytes
                    outFieldExpr: "'metric_name.bytes'"
                    metricType: gauge
                  - inFieldName: packets
                    outFieldExpr: "'metric_name.packets'"
                    metricType: gauge
                overwrite: false
                dimensions:
                  - action
                  - interface_id
                  - dstaddr
                removeMetrics: []
                removeDimensions: []
    PipelineExamplesRedis:
      summary: Pipeline with Redis function interacting with Redis stores to set and
        get key-value pairs
      value:
        id: redis-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that retrieves values from Redis using GET command
          functions:
            - id: redis
              filter: "true"
              conf:
                commands:
                  - outField: cached_value
                    command: get
                    keyExpr: "'user_session'"
                    argsExpr: ""
                deploymentType: standalone
                url: "'redis://localhost:6379/0'"
                authType: none
                maxBlockSecs: 60
    PipelineExamplesRegexExtract:
      summary: Pipeline with regex extract function extracting fields from events
        using regular expressions with named capture groups
      value:
        id: regex-extract-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that extracts structured fields from log data using regex
            patterns with named capture groups
          functions:
            - id: regex_extract
              filter: "true"
              conf:
                regex: /metric1=(?<metric1>\d+)/
                source: _raw
                iterations: 100
                overwrite: false
    PipelineExamplesRegexFilter:
      summary: Pipeline with regex filter function filtering out events based on
        regular expression matches
      value:
        id: regex-filter-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that filters out events matching specific regex patterns
          functions:
            - id: regex_filter
              filter: "true"
              conf:
                regex: /Opera/
                field: _raw
    PipelineExamplesRename:
      summary: Pipeline with rename function changing or reformatting field names
        within events
      value:
        id: rename-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that renames fields using key-value pairs and expressions
          functions:
            - id: rename
              filter: "true"
              conf:
                rename:
                  - currentName: level
                    newName: LEVEL
                renameExpr: "name.startsWith('out') ? name.toUpperCase() : name"
                baseFields: []
                wildcardDepth: 5
    PipelineExamplesRollupMetrics:
      summary: Pipeline with rollup metrics function consolidating high-frequency
        metrics into time windows
      value:
        id: rollup-metrics-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that consolidates high-frequency metrics into manageable
            time windows
          functions:
            - id: rollup_metrics
              filter: "true"
              conf:
                dimensions:
                  - "*"
                timeWindow: 30s
                gaugeRollup: last
    PipelineExamplesSampling:
      summary: Pipeline with sampling function filtering events based on criteria and
        sampling rates
      value:
        id: sampling-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that samples events at specified rates based on filter
            criteria
          functions:
            - id: sampling
              filter: "true"
              conf:
                rules:
                  - filter: __status == 200
                    rate: 5
    PipelineExamplesSerialize:
      summary: Pipeline with serialize function converting event content into
        predefined formats
      value:
        id: serialize-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that serializes event fields into JSON format
          functions:
            - id: serialize
              filter: "true"
              conf:
                type: json
                fields:
                  - city
                  - state
                srcField: ""
                dstField: _raw
    PipelineExamplesSNMPTrapSerialize:
      summary: Pipeline with SNMP trap serialize function converting compliant events
        into SNMP traps
      value:
        id: snmp-trap-serialize-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that serializes events into SNMP trap format for SNMP trap
            destinations
          functions:
            - id: snmp_trap_serialize
              filter: "true"
              conf:
                strict: true
                dropFailedEvents: true
    PipelineExamplesSuppress:
      summary: Pipeline with suppress function suppressing duplicate events based on
        key expressions
      value:
        id: suppress-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that suppresses duplicate events based on a key expression
          functions:
            - id: suppress
              filter: "true"
              conf:
                keyExpr: "`${ip}:${port}`"
                allow: 1
                suppressPeriodSec: 30
                dropEventsMode: true
                maxCacheSize: 50000
                cacheIdleTimeoutPeriods: 2
                numEventsIdleTimeoutTrigger: 10000
    PipelineExamplesTee:
      summary: Pipeline with tee function sending events to a command via stdin for
        debugging and verification
      value:
        id: tee-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that sends events to a command via stdin for debugging
            purposes
          functions:
            - id: tee
              filter: "true"
              conf:
                command: tee
                args:
                  - /opt/cribl/foo.log
                restartOnExit: true
                env: {}
    PipelineExamplesUnroll:
      summary: Pipeline with unroll function breaking array fields into individual
        events
      value:
        id: unroll-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that unrolls array fields into separate events
          functions:
            - id: unroll
              filter: "true"
              conf:
                srcExpr: _raw.split(/\n/)
                dstField: _raw
    PipelineExamplesXMLUnroll:
      summary: Pipeline with XML unroll function converting XML elements into
        individual events
      value:
        id: xml-unroll-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that unrolls XML elements into separate events
          functions:
            - id: xml_unroll
              filter: "true"
              conf:
                unroll: ^Parent\.Child$
                inherit: ^Parent\.(myID|branchLocation)$
                unrollIdxField: unroll_idx
                pretty: false
    UpdatePipelineExamplesEmpty:
      summary: New empty Pipeline
      value:
        id: empty-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          functions: []
          description: ""
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesAggregations:
      summary: Pipeline with aggregation function summing rejected bytes grouped by
        source address
      value:
        id: aggregation-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that aggregates rejected bytes grouped by source address
            every 10 seconds
          functions:
            - id: aggregation
              filter: "true"
              conf:
                passthrough: false
                preserveGroupBys: false
                sufficientStatsOnly: false
                metricsMode: false
                timeWindow: 10s
                aggregations:
                  - sum(bytes).where(action=="REJECT").as(TotalBytes)
                groupbys:
                  - srcaddr
                cumulative: false
                shouldTreatDotsAsLiterals: false
                flushOnInputClose: true
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesAggregateMetrics:
      summary: Pipeline with aggregate metrics function computing statistics on
        process metrics
      value:
        id: aggregate-metrics-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: "Pipeline that aggregates process metrics: CPU, memory, and bytes
            over time windows"
          functions:
            - id: aggregate_metrics
              filter: (_metric == 'proc.cpu_perc' ||
                __criblMetrics[0].nameExpr.includes("'proc.cpu_perc'")) ||
                (_metric == 'proc.mem_perc' ||
                __criblMetrics[0].nameExpr.includes("'proc.mem_perc'")) ||
                (_metric == 'proc.bytes_in' ||
                __criblMetrics[0].nameExpr.includes("'proc.bytes_in'"))
              conf:
                passthrough: false
                preserveGroupBys: false
                sufficientStatsOnly: false
                timeWindow: 10s
                aggregations:
                  - metricType: gauge
                    agg: avg(_value || proc.cpu_perc).as(proc.cpu_perc_avg)
                  - metricType: gauge
                    agg: sum(_value || proc.mem_perc).as(proc.mem_perc_sum)
                  - metricType: counter
                    agg: count(_value || proc.bytes_in).as(proc.bytes_in_count)
                groupbys:
                  - proc
                cumulative: false
                shouldTreatDotsAsLiterals: true
                flushOnInputClose: true
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesAutoTimestamp:
      summary: Pipeline with auto timestamp function extracting timestamps from event
        data
      value:
        id: auto-timestamp-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that extracts timestamps from event data using auto
            timestamp function
          functions:
            - id: auto_timestamp
              filter: "true"
              conf:
                srcField: _raw
                dstField: _time
                defaultTimezone: local
                timeExpression: time.getTime() / 1000
                offset: 0
                maxLen: 150
                defaultTime: now
                latestDateAllowed: +1week
                earliestDateAllowed: -420weeks
                timestamps:
                  - regex: /(\d{1,2}\/\d{2}\/\d{4}\s\d{1,2}:\d{2}:\d{2}\s\w{2})/
                    strptime: "%Y-%m-%d %H:%M:%S"
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesCEFSerializer:
      summary: Pipeline with CEF serializer function formatting events in Common Event
        Format
      value:
        id: cef-serializer-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that formats events in CEF format with custom header and
            extension fields
          functions:
            - id: cef
              filter: "true"
              conf:
                outputField: _raw
                header:
                  - name: cef_version
                    value: "'CEF:0'"
                  - name: device_vendor
                    value: "'Cribl'"
                  - name: device_product
                    value: "'Cribl'"
                  - name: device_version
                    value: C.version
                  - name: device_event_class_id
                    value: "420"
                  - name: name
                    value: "'Cribl Event'"
                  - name: severity
                    value: "6"
                extension:
                  - name: c6a1Label
                    value: "'Colorado_Ext_Bldg7'"
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesChain:
      summary: Pipeline with chain function connecting to another pipeline for
        sequential processing
      value:
        id: chain-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that chains to another pipeline for sequential data
            processing
          functions:
            - id: chain
              filter: "true"
              conf:
                processor: prometheus_metrics
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesClone:
      summary: Pipeline with clone function creating copies of events with additional
        fields
      value:
        id: clone-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that creates cloned events with additional fields for
            comparison or routing
          functions:
            - id: clone
              filter: "true"
              conf:
                clones:
                  - env: staging
                  - index: clones
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesComment:
      summary: Pipeline with comment function adding documentation annotations
      value:
        id: comment-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline with comment function for documentation
          functions:
            - id: comment
              filter: "true"
              conf:
                comment: This function processes security events and enriches them with DNS
                  lookups
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesDNSLookup:
      summary: Pipeline with DNS lookup function resolving hostnames and IP addresses
      value:
        id: dns-lookup-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that performs DNS lookups to resolve hostnames and IP
            addresses
          functions:
            - id: dns_lookup
              filter: "true"
              conf:
                dnsLookupFields:
                  - inFieldName: hostname
                    resourceRecordType: A
                    outFieldName: hostname_ip
                reverseLookupFields:
                  - inFieldName: src_ip
                    outFieldName: src_hostname
                cacheTTL: 30
                maxCacheSize: 5000
                useResolvConf: false
                lookupFallback: false
                lookupFailLogLevel: error
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesDrop:
      summary: Pipeline with drop function filtering out events matching specified
        criteria
      value:
        id: drop-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that drops events containing success messages
          functions:
            - id: drop
              filter: _raw.search(/success/i)>=0
              conf: {}
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesDropDimensions:
      summary: Pipeline with drop dimensions function reducing metric cardinality by
        removing dimensions
      value:
        id: drop-dimensions-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that drops specified dimensions from metrics to reduce
            cardinality
          functions:
            - id: drop_dimensions
              filter: (_metric == 'proc.cpu_perc' ||
                __criblMetrics[0].nameExpr.includes("'proc.cpu_perc'")) &&
                (__criblMetrics[0].dims.includes("proc"))
              conf:
                timeWindow: 10s
                dropDimensions:
                  - proc
                  - pie
                  - unit
                flushOnInputClose: true
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesDynamicSampling:
      summary: Pipeline with dynamic sampling function automatically adjusting sample
        rates based on event volume
      value:
        id: dynamic-sampling-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that dynamically samples events based on volume using
            square root mode
          functions:
            - id: dynamic_sampling
              filter: "true"
              conf:
                mode: sqrt
                keyExpr: "`${domain}:${httpCode}`"
                samplePeriod: 20
                minEvents: 3
                maxSampleRate: 3
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesEval:
      summary: Pipeline with eval function adding, modifying, and removing event
        fields using JavaScript expressions
      value:
        id: eval-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that evaluates JavaScript expressions to add, modify, and
            remove fields
          functions:
            - id: eval
              filter: "true"
              conf:
                add:
                  - name: action
                    value: "login == 'error' ? 'blocked' : action"
                  - name: myTags
                    value: "login == 'error' ? [...myTags, 'error'] : myTags"
                keep:
                  - host
                  - source
                  - action
                  - myTags
                remove:
                  - identification
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesEventBreaker:
      summary: Pipeline with event breaker function splitting large blobs or streams
        into discrete events
      value:
        id: event-breaker-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that breaks large event streams into discrete events using
            regex
          functions:
            - id: event_breaker
              filter: "true"
              conf:
                existingOrNew: new
                ruleType: regex
                eventBreakerRegex: /[\n\r]+(?!\s)/
                maxEventBytes: 51200
                timestampAnchorRegex: /^/
                timestamp:
                  type: auto
                  length: 150
                timestampTimezone: local
                timestampEarliest: -420weeks
                timestampLatest: +1week
                shouldMarkCriblBreaker: true
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesFlatten:
      summary: Pipeline with flatten function pulling nested fields up to a higher
        level in the object
      value:
        id: flatten-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that flattens nested JSON structures into top-level fields
          functions:
            - id: flatten
              filter: "true"
              conf:
                fields: []
                prefix: ""
                depth: 5
                delimiter: _
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesFoldKeys:
      summary: Pipeline with fold keys function transforming flat field names into
        nested structures
      value:
        id: fold-keys-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that transforms flat field names with separators into
            nested structures
          functions:
            - id: foldkeys
              filter: "true"
              conf:
                deleteOriginal: true
                separator: _
                selectionRegExp: ^data
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesGeoIP:
      summary: Pipeline with GeoIP function enriching events with geographic
        information based on IP addresses
      value:
        id: geoip-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that enriches events with geolocation data from IP addresses
          functions:
            - id: geoip
              filter: "true"
              conf:
                file: GeoLite2-City.mmdb
                inField: ip
                outField: geoip
                additionalFields:
                  - extraInField: src_ip
                    extraOutField: src_geoip
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesGrok:
      summary: Pipeline with grok function extracting structured fields from
        unstructured log data using patterns
      value:
        id: grok-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that extracts structured fields from log data using Grok
            patterns
          functions:
            - id: grok
              filter: "true"
              conf:
                pattern: "%{TIMESTAMP_ISO8601:event_time} %{LOGLEVEL:log_level}
                  %{GREEDYDATA:log_message}"
                source: _raw
                patternList: []
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesGuard:
      summary: Pipeline with guard function detecting and protecting sensitive data
        using AI-driven scanning rulesets
      value:
        id: guard-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that scans for sensitive data and applies mitigation
            expressions
          functions:
            - id: sensitive_data_scanner
              filter: "true"
              conf:
                rules:
                  - rulesetId: Finance_Global
                    replaceExpr: "'REDACTED'"
                    disabled: false
                fields:
                  - _raw
                excludeFields: []
                flags:
                  - name: _sensitive
                    value: "true"
                includeDetectedRules: true
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesJSONUnroll:
      summary: Pipeline with JSON unroll function exploding arrays of objects into
        individual events
      value:
        id: json-unroll-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that unrolls JSON arrays into individual events while
            retaining parent fields
          functions:
            - id: json_unroll
              filter: "true"
              conf:
                path: allCars
                name: cars
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesLookup:
      summary: Pipeline with lookup function enriching events with external fields
        from lookup tables
      value:
        id: lookup-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that enriches events with location data from IP address
            lookups
          functions:
            - id: lookup
              filter: "true"
              conf:
                file: ip_locations.csv
                dbLookup: false
                matchMode: exact
                reloadPeriodSec: -1
                inFields:
                  - eventField: destination_ip
                    lookupField: ip
                outFields:
                  - lookupField: location
                    eventField: location
                    defaultValue: Unknown
                addToEvent: false
                ignoreCase: false
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesMask:
      summary: Pipeline with mask function redacting sensitive data using pattern
        matching and replacement
      value:
        id: mask-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that masks Social Security numbers and other sensitive data
          functions:
            - id: mask
              filter: "true"
              conf:
                rules:
                  - matchRegex: /(social=)(\d+)/
                    replaceExpr: "`${g1}${C.Mask.md5(g2)}`"
                    disabled: false
                fields:
                  - _raw
                depth: 5
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesNumerify:
      summary: Pipeline with numerify function converting string numbers to numeric type
      value:
        id: numerify-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that converts string numbers to numeric type for
            mathematical operations
          functions:
            - id: numerify
              filter: "true"
              conf:
                depth: 5
                ignoreFields: []
                filterExpr: ""
                format: none
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesOTLPLogs:
      summary: Pipeline with OTLP logs function normalizing and batching OpenTelemetry
        log events
      value:
        id: otlp-logs-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that normalizes and batches OTLP log events from
            OpenTelemetry sources
          functions:
            - id: otlp_logs
              filter: __inputId=='open_telemetry:open_telemetry'
              conf:
                dropNonLogEvents: false
                batchOTLPLogs: true
                sendBatchSize: 8192
                timeout: 200
                sendBatchMaxSize: 0
                metadataKeys: []
                metadataCardinalityLimit: 1000
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesOTLPMetrics:
      summary: Pipeline with OTLP metrics function converting dimensional metrics to
        OpenTelemetry format
      value:
        id: otlp-metrics-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that converts dimensional metrics to OTLP format and
            batches them by resource attributes
          functions:
            - id: otlp_metrics
              filter: __inputId=='prometheus_rw:prom_rw_in'
              conf:
                resourceAttributePrefixes:
                  - service
                  - system
                  - telemetry
                  - k8s
                  - cloud
                  - host
                  - process
                dropNonMetricEvents: false
                otlpVersion: 0.10.0
                batchOTLPMetrics: true
                sendBatchSize: 8192
                timeout: 200
                sendBatchMaxSize: 0
                metadataKeys: []
                metadataCardinalityLimit: 1000
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesOTLPTraces:
      summary: Pipeline with OTLP traces function normalizing and batching
        OpenTelemetry trace events
      value:
        id: otlp-traces-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that normalizes and batches OTLP trace events from
            OpenTelemetry sources
          functions:
            - id: otlp_traces
              filter: __inputId=='open_telemetry:open_telemetry'
              conf:
                dropNonTraceEvents: false
                otlpVersion: 0.10.0
                batchOTLPTraces: true
                sendBatchSize: 8192
                timeout: 200
                sendBatchMaxSize: 0
                metadataKeys: []
                metadataCardinalityLimit: 1000
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesParser:
      summary: Pipeline with parser function extracting fields from key-value pairs
      value:
        id: parser-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that extracts fields from key-value pair formatted data
          functions:
            - id: serde
              filter: "true"
              conf:
                mode: extract
                type: kvp
                srcField: _raw
                keep:
                  - a
                  - b
                  - c
                remove:
                  - "*"
                cleanFields: false
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesPublishMetrics:
      summary: Pipeline with publish metrics function extracting and formatting
        metrics from events
      value:
        id: publish-metrics-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that extracts metrics from events and formats them for
            metrics aggregation platforms
          functions:
            - id: publish_metrics
              filter: "true"
              conf:
                fields:
                  - inFieldName: bytes
                    outFieldExpr: "'metric_name.bytes'"
                    metricType: gauge
                  - inFieldName: packets
                    outFieldExpr: "'metric_name.packets'"
                    metricType: gauge
                overwrite: false
                dimensions:
                  - action
                  - interface_id
                  - dstaddr
                removeMetrics: []
                removeDimensions: []
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesRedis:
      summary: Pipeline with Redis function interacting with Redis stores to set and
        get key-value pairs
      value:
        id: redis-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that retrieves values from Redis using GET command
          functions:
            - id: redis
              filter: "true"
              conf:
                commands:
                  - outField: cached_value
                    command: get
                    keyExpr: "'user_session'"
                    argsExpr: ""
                deploymentType: standalone
                url: "'redis://localhost:6379/0'"
                authType: none
                maxBlockSecs: 60
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesRegexExtract:
      summary: Pipeline with regex extract function extracting fields from events
        using regular expressions with named capture groups
      value:
        id: regex-extract-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that extracts structured fields from log data using regex
            patterns with named capture groups
          functions:
            - id: regex_extract
              filter: "true"
              conf:
                regex: /metric1=(?<metric1>\d+)/
                source: _raw
                iterations: 100
                overwrite: false
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesRegexFilter:
      summary: Pipeline with regex filter function filtering out events based on
        regular expression matches
      value:
        id: regex-filter-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that filters out events matching specific regex patterns
          functions:
            - id: regex_filter
              filter: "true"
              conf:
                regex: /Opera/
                field: _raw
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesRename:
      summary: Pipeline with rename function changing or reformatting field names
        within events
      value:
        id: rename-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that renames fields using key-value pairs and expressions
          functions:
            - id: rename
              filter: "true"
              conf:
                rename:
                  - currentName: level
                    newName: LEVEL
                renameExpr: "name.startsWith('out') ? name.toUpperCase() : name"
                baseFields: []
                wildcardDepth: 5
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesRollupMetrics:
      summary: Pipeline with rollup metrics function consolidating high-frequency
        metrics into time windows
      value:
        id: rollup-metrics-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that consolidates high-frequency metrics into manageable
            time windows
          functions:
            - id: rollup_metrics
              filter: "true"
              conf:
                dimensions:
                  - "*"
                timeWindow: 30s
                gaugeRollup: last
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesSampling:
      summary: Pipeline with sampling function filtering events based on criteria and
        sampling rates
      value:
        id: sampling-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that samples events at specified rates based on filter
            criteria
          functions:
            - id: sampling
              filter: "true"
              conf:
                rules:
                  - filter: __status == 200
                    rate: 5
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesSerialize:
      summary: Pipeline with serialize function converting event content into
        predefined formats
      value:
        id: serialize-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that serializes event fields into JSON format
          functions:
            - id: serialize
              filter: "true"
              conf:
                type: json
                fields:
                  - city
                  - state
                srcField: ""
                dstField: _raw
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesSNMPTrapSerialize:
      summary: Pipeline with SNMP trap serialize function converting compliant events
        into SNMP traps
      value:
        id: snmp-trap-serialize-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that serializes events into SNMP trap format for SNMP trap
            destinations
          functions:
            - id: snmp_trap_serialize
              filter: "true"
              conf:
                strict: true
                dropFailedEvents: true
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesSuppress:
      summary: Pipeline with suppress function suppressing duplicate events based on
        key expressions
      value:
        id: suppress-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that suppresses duplicate events based on a key expression
          functions:
            - id: suppress
              filter: "true"
              conf:
                keyExpr: "`${ip}:${port}`"
                allow: 1
                suppressPeriodSec: 30
                dropEventsMode: true
                maxCacheSize: 50000
                cacheIdleTimeoutPeriods: 2
                numEventsIdleTimeoutTrigger: 10000
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesTee:
      summary: Pipeline with tee function sending events to a command via stdin for
        debugging and verification
      value:
        id: tee-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that sends events to a command via stdin for debugging
            purposes
          functions:
            - id: tee
              filter: "true"
              conf:
                command: tee
                args:
                  - /opt/cribl/foo.log
                restartOnExit: true
                env: {}
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesUnroll:
      summary: Pipeline with unroll function breaking array fields into individual
        events
      value:
        id: unroll-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that unrolls array fields into separate events
          functions:
            - id: unroll
              filter: "true"
              conf:
                srcExpr: _raw.split(/\n/)
                dstField: _raw
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    UpdatePipelineExamplesXMLUnroll:
      summary: Pipeline with XML unroll function converting XML elements into
        individual events
      value:
        id: xml-unroll-pipeline
        conf:
          output: default
          streamtags: []
          groups: {}
          asyncFuncTimeout: 1000
          description: Pipeline that unrolls XML elements into separate events
          functions:
            - id: xml_unroll
              filter: "true"
              conf:
                unroll: ^Parent\.Child$
                inherit: ^Parent\.(myID|branchLocation)$
                unrollIdxField: unroll_idx
                pretty: false
      description: Example request body for updating a Pipeline.<br/><br/>The request
        body must include a complete representation of the Pipeline that you
        want to update. This endpoint does not support partial updates.
    CreateProfilerExamplesProfileWorker:
      summary: Start a CPU profile capture for a Worker Process
      description: Example request body for starting a CPU profile capture for Worker
        Process <code>w0</code> to diagnose performance issues.
      value:
        id: w0
        profId: "1735123456789"
    RoutesUpdateExamplesBasicRoute:
      summary: Update Routes with a basic Route configuration
      description: "Example request body for updating the default Routes table
        (<code>id: default</code>) with a simple Route that filters access.log
        events and sends them to the main Pipeline.<br/><br/>The request body
        must include a complete representation of the Routing table that you
        want to update. This endpoint does not support partial updates."
      value:
        id: default
        routes:
          - id: default
            name: my-route
            pipeline: main
            filter: source == "access.log"
            description: Route access logs to main Pipeline
            final: true
    RoutesUpdateExamplesMultipleRoutes:
      summary: Update Routes with multiple Routes and a catch-all
      description: "Example request body for updating the default Routes table
        (<code>id: default</code>) with multiple specific Routes evaluated in
        order, followed by a default catch-all Route.<br/><br/>The request body
        must include a complete representation of the Routing table that you
        want to update. This endpoint does not support partial updates."
      value:
        id: default
        routes:
          - id: route-speedtest
            name: speedtest
            pipeline: main
            output: default
            filter: source == "speedtest.log"
            description: Route speedtest logs
            final: false
          - id: route-mtr
            name: mtr
            pipeline: passthru
            output: default
            filter: source == "mtr.log"
            description: Route mtr logs
            final: false
          - id: route-statsd
            name: statsd
            pipeline: prometheus_metrics
            output: devnull
            filter: source == "statsd.log"
            description: Route statsd metrics
            final: false
          - id: route-default
            name: default
            pipeline: main
            output: default
            filter: "true"
            description: Catch-all Route for all other events
            final: true
    RoutesUpdateExamplesRouteWithOutputExpression:
      summary: Update Routes with dynamic Destination expression
      description: "Example request body for updating the default Routes table
        (<code>id: default</code>) with a Route that uses a JavaScript
        expression to dynamically determine the Destination.<br/><br/>The
        request body must include a complete representation of the Routing table
        that you want to update. This endpoint does not support partial
        updates."
      value:
        id: default
        routes:
          - id: route-dynamic
            name: dynamic-output
            pipeline: main
            enableOutputExpression: true
            outputExpression: "`myDest_${C.logStreamEnv}`"
            filter: source == "dynamic.log"
            description: Route with dynamic Destination based on environment
            final: true
    RoutesUpdateExamplesRouteWithDefaults:
      summary: Update the basic Route configuration
      description: "Example request body for updating the default Routes table
        (<code>id: default</code>) with a basic Route that omits the
        <code>id</code> and <code>final</code> fields. The server generates a
        deterministic <code>id</code> and sets <code>final</code> to
        <code>true</code> by default.<br/><br/>The request body must include a
        complete representation of the Routing table that you want to update.
        This endpoint does not support partial updates."
      value:
        id: default
        routes:
          - name: my-route
            pipeline: main
            filter: source == "access.log"
            description: Route access logs to main Pipeline
    RoutesAppendExamplesSingleRoute:
      summary: Append a single Route to the Routing table
      description: "Add a single Route to the end of the default Routes table (id: default)"
      value:
        - id: route-new
          name: new-route
          pipeline: main
          filter: source == "new.log"
          description: Route new logs to main pipeline
          final: true
    RoutesAppendExamplesMultipleRoutes:
      summary: Append multiple Routes to the Routing table
      description: "Add multiple Routes to the end of the default Routes table (id:
        default)"
      value:
        - id: route-audit
          name: audit
          pipeline: main
          output: default
          filter: source == "audit.log"
          description: Route audit logs
          final: false
        - id: route-security
          name: security
          pipeline: passthru
          output: devnull
          filter: source == "security.log"
          description: Route security logs
          final: false
    RoutesAppendExamplesRouteWithOutputExpression:
      summary: Append a Route with dynamic Destination expression
      description: "Add a Route to the end of the default Routes table (id: default)
        that uses a JavaScript expression to dynamically determine the
        Destination"
      value:
        - id: route-dynamic-append
          name: dynamic-append
          pipeline: main
          enableOutputExpression: true
          outputExpression: "`myDest_${C.logStreamEnv}`"
          filter: source == "dynamic.log"
          description: Route with dynamic Destination based on environment
          final: true
    RoutesAppendExamplesRouteWithDefaults:
      summary: Append a Route omitting optional id and final fields
      description: "Example request body for adding a Route to the end of the default
        Routes table (<code>id: default</code>) omitting the <code>id</code> and
        <code>final</code> fields. The server generates a deterministic
        <code>id</code> and sets <code>final</code> to <code>true</code> by
        default."
      value:
        - name: new-route
          pipeline: main
          filter: source == "new.log"
          description: Route with server-generated id and default final value
    SchemaExamplesEventData:
      summary: JSON schema for structured event data
      description: Example request body for creating a JSON schema for validating
        structured event data with required timestamp, source, and message
        fields.
      value:
        id: event-data-schema
        description: JSON schema for validating structured event data
        schema: '{"type":"object","properties":{"timestamp":{"type":"string"},"source":{"type":"string"},"message":{"type":"string"},"severity":{"type":"integer"}},"required":["timestamp","source","message"]}'
    SchemaExamplesUserActivity:
      summary: JSON schema for user activity log entries
      description: Example request body for creating a JSON schema for validating user
        activity log entries with required userId, action, and timestamp fields.
      value:
        id: user-activity-schema
        description: JSON schema for validating user activity log entries
        schema: '{"type":"object","properties":{"userId":{"type":"string"},"action":{"type":"string"},"timestamp":{"type":"string","format":"date-time"},"metadata":{"type":"object"}},"required":["userId","action","timestamp"]}'
    CreateSecretExamplesTextSecret:
      summary: Create a text secret
      description: Example request body for creating a secret that stores a single
        text value.
      value:
        id: my-api-key
        secretType: text
        value: supersecretvalue123
        description: API key for external service
    CreateSecretExamplesCredentialSecret:
      summary: Create a credentials secret
      description: Example request body for creating a secret that stores a username
        and password pair.
      value:
        id: db-credentials
        secretType: credentials
        username: db_user
        password: db_password
        description: Database credentials
    CreateSecretExamplesKeypairSecret:
      summary: Create a keypair secret
      description: Example request body for creating a secret that stores an API key
        and secret key pair.
      value:
        id: aws-keypair
        secretType: keypair
        apiKey: AKIAIOSFODNN7EXAMPLE
        secretKey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
        description: AWS access credentials
    UpdateSecretExamplesUpdateTextSecret:
      summary: Update a text secret
      description: Example request body for updating the value of an existing text
        secret.<br/><br/>The request body must include a complete representation
        of the secret that you want to update. This endpoint does not support
        partial updates.
      value:
        id: my-api-key
        secretType: text
        value: newsecretvalue456
        description: API key for external service
    UpdateSecretExamplesUpdateKeypairSecret:
      summary: Update a keypair secret
      description: Example request body for rotating the API key and secret key of an
        existing keypair secret.<br/><br/>The request body must include a
        complete representation of the secret that you want to update. This
        endpoint does not support partial updates.
      value:
        id: aws-keypair
        secretType: keypair
        apiKey: AKIAI44QH8DHBEXAMPLE
        secretKey: je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY
        description: AWS access credentials
    OutpostConfigExamplesOutpostConfig:
      summary: Update Outpost Node
      description: Example request body for updating the Outpost Node listener
        configuration.
      value:
        listener:
          host: 0.0.0.0
          port: 4200
          tls:
            disabled: true
    PQOrphanManagementConfigExamplesDefaults:
      summary: Configure default orphan management settings
      description: Example request body for configuring orphan management using
        default settings.<br/><br/>The request body must include a complete
        representation of the orphan management configuration that you want to
        update. This endpoint does not support partial updates.
      value:
        scanInterval: 1
        orphanDetectionThreshold: 20
        disabled: false
    PQOrphanManagementConfigExamplesFrequentScan:
      summary: Configure frequent storage scans with shorter orphan threshold
      description: Example request body for configuring aggressive orphan detection
        for auto-scaling environments. Persistent queue (PQ) storage is scanned
        every 5 minutes, and Workers are considered orphaned after 5 minutes
        without appearing in the active set.<br/><br/>The request body must
        include a complete representation of the orphan management configuration
        that you want to update. This endpoint does not support partial updates.
      value:
        scanInterval: 5
        orphanDetectionThreshold: 5
        disabled: false
    PQOrphanManagementConfigExamplesDisabled:
      summary: Disable orphan management
      description: Example request body for disabling orphan management. Use when
        Workers may be offline for long periods and automatic reassignment is
        undesirable.<br/><br/>The request body must include a complete
        representation of the orphan management configuration that you want to
        update. This endpoint does not support partial updates.
      value:
        scanInterval: 1
        orphanDetectionThreshold: 20
        disabled: true
    PQStorageConfigExamplesFileSystem:
      summary: Configure local filesystem-based PQ storage
      description: "Example request body for configuring local filesystem storage for
        PQ. No additional body parameters are allowed when <code>type:
        'fs'</code>."
      value:
        type: fs
    PQStorageConfigExamplesNetworkFileSystemMinimal:
      summary: Configure NFS-based PQ storage with minimum requirements
      description: Example request body for configuring minimum valid NFS-based PQ
        storage, which requires only <code>type</code> and
        <code>mountPoint</code>. Default values will be used for size limits and
        compression.
      value:
        type: nfs
        mountPoint: ${CRIBL_WORKER_VOLUME}/worker
    PQStorageConfigExamplesNetworkFileSystem:
      summary: Configure NFS-based PQ storage with size limits and compression
      description: Example request body for configuring NFS-based PQ storage, with
        size limits specified and compression enabled. Size values use a numeral
        plus unit, such as 10MB or 1GB.
      value:
        type: nfs
        mountPoint: ${CRIBL_WORKER_VOLUME}/worker
        maxSize: 1GB
        maxBufferSizeBytes: 1MB
        maxFileSize: 10MB
        compression: true
    PQStorageConfigExamplesS3Auto:
      summary: Configure S3-based PQ storage using default AWS credential chain
      description: "Example request body for configuring S3-based PQ storage using
        <code>awsAuthenticationMethod: `auto`</code>, which requires
        <code>bucket</code> and <code>prefix</code>.<br/><br/>The default value
        for <code>optimizeCost</code> is <code>true</code>, which favors fewer
        S3 uploads. Change the setting to <code>false</code> to upload sealed
        slice files to the S3 bucket as soon as possible.<br/><br/>The request
        body must include a complete representation of the PQ storage
        configuration that you want to update. This endpoint does not support
        partial updates."
      value:
        type: s3
        bucket: my-pq-bucket
        prefix: mygroup
        awsAuthenticationMethod: auto
        maxSize: 2GB
        compression: false
        optimizeCost: true
    PQStorageConfigExamplesS3Manual:
      summary: Configure S3-based PQ storage using an access key and secret key
      description: "Example request body for configuring S3-based PQ storage using
        <code>awsAuthenticationMethod: 'manual'</code>. The
        <code>awsApiKey</code> and <code>awsSecretKey</code> values can be
        plaintext strings or expressions that resolve at runtime."
      value:
        type: s3
        bucket: my-pq-bucket
        prefix: mygroup
        awsAuthenticationMethod: manual
        awsApiKey: AKIAIOSFODNN7EXAMPLE
        awsSecretKey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
        region: us-east-1
    PQStorageConfigExamplesS3Secret:
      summary: Configure S3-based PQ storage using credentials from a stored secret
      description: "Example request body for configuring S3-based PQ storage using
        <code>awsAuthenticationMethod: 'secret'</code>. The value for
        <code>awsSecret</code> references a Cribl secret that holds the access
        key pair."
      value:
        type: s3
        bucket: my-pq-bucket
        prefix: mygroup
        awsAuthenticationMethod: secret
        awsSecret: my-secret-id
        region: eu-west-1
    PQStorageConfigExamplesS3AssumeRole:
      summary: Configure S3-based PQ storage with assume role
      description: Example request body for configuring S3-based PQ storage that
        enables assume role after resolving auto or manual base credentials.
        Requires <code>assumeRoleArn</code>. Include
        <code>assumeRoleExternalId</code> if the trust policy requires it.
      value:
        type: s3
        bucket: my-pq-bucket
        prefix: mygroup
        awsAuthenticationMethod: auto
        enableAssumeRole: true
        assumeRoleArn: arn:aws:iam::123456789012:role/CriblPQRole
        assumeRoleExternalId: cribl-pq-external-id
        region: us-west-2
    GrokFileExamplesCustomPattern:
      summary: Custom Grok pattern
      description: Example request body for creating a Grok file that specifies a
        custom timestamp and application log patterns for use in Grok-based
        parsers.
      value:
        id: custom-app-patterns
        content: >-
          CUSTOM_TIMESTAMP %{YEAR}-%{MONTHNUM}-%{MONTHDAY}
          %{HOUR}:%{MINUTE}:%{SECOND}

          APP_LOG \[%{CUSTOM_TIMESTAMP:timestamp}\] %{LOGLEVEL:level}
          %{GREEDYDATA:message}
        size: 175
    GrokFileExamplesNetworkPatterns:
      summary: Firewall and network log Grok patterns
      description: Example request body for creating a Grok file with firewall and
        network log patterns for parsing firewall action logs.
      value:
        id: network-patterns
        content: >-
          FIREWALL_ACTION (ACCEPT|DROP|REJECT)

          FIREWALL_LOG %{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host}
          %{FIREWALL_ACTION:action} %{IP:src_ip}:%{POSINT:src_port} ->
          %{IP:dst_ip}:%{POSINT:dst_port}
        size: 180
    CollectorExamplesRest:
      summary: REST API Collector
      value:
        id: rest-collector
        type: collection
        schedule:
          enabled: true
          cronSchedule: 0 */4 * * *
          tz: UTC
          run:
            mode: run
            timeRangeType: relative
            earliest: -300
            expression: "true"
            logLevel: info
        collector:
          type: rest
          sendToRoutes: true
          throttleRatePerSec: 100
          conf:
            collectUrl: "'https://api.example.com/data'"
            collectMethod: get
            authentication: none
            decodeUrl: true
            timeout: 600
        pipelines:
          - main
        destinations:
          - default
    CollectorExamplesS3:
      summary: S3 Bucket Collector
      value:
        id: s3-collector
        type: collection
        schedule:
          enabled: true
          cronSchedule: 0 */6 * * *
          tz: UTC
          run:
            mode: run
            timeRangeType: relative
            earliest: -300
            expression: "true"
            logLevel: info
        collector:
          type: s3
          sendToRoutes: true
          throttleRatePerSec: 500
          conf:
            bucket: "'my-data-bucket'"
            region: us-east-1
            pattern: "*.json"
            awsAuthenticationMethod: auto
            partitioningScheme: ddss
        pipelines:
          - data-processing
        destinations:
          - s3-output
    CollectorExamplesFilesystem:
      summary: Filesystem Collector
      value:
        id: filesystem-collector
        type: collection
        schedule:
          enabled: true
          cronSchedule: 0 */2 * * *
          tz: UTC
          run:
            mode: run
            timeRangeType: relative
            earliest: -300
            expression: "true"
            logLevel: info
        collector:
          type: filesystem
          sendToRoutes: true
          throttleRatePerSec: 1000
          conf:
            path: "'/var/log/application/*.log'"
        pipelines:
          - log-processing
        destinations:
          - elasticsearch
    CollectorExamplesAzureBlob:
      summary: Azure Blob Storage Collector
      value:
        id: azure-blob-collector
        type: collection
        schedule:
          enabled: true
          cronSchedule: 0 */8 * * *
          tz: UTC
          run:
            mode: run
            timeRangeType: relative
            earliest: -300
            expression: "true"
            logLevel: info
        collector:
          type: azure_blob
          sendToRoutes: true
          throttleRatePerSec: 200
          conf:
            accountName: "'mystorageaccount'"
            containerName: "'data-container'"
            pattern: "'*.json'"
            authType: manual
            connectionString: "'DefaultEndpointsProtocol=https;AccountName=mystorageaccount\
              ;AccountKey=...'"
        pipelines:
          - data-pipeline
        destinations:
          - azure-output
    CollectorExamplesGoogleCloudStorage:
      summary: Google Cloud Storage Collector
      value:
        id: gcs-collector
        type: collection
        schedule:
          enabled: true
          cronSchedule: 0 */12 * * *
          tz: UTC
          run:
            mode: run
            timeRangeType: relative
            earliest: -300
            expression: "true"
            logLevel: info
        collector:
          type: google_cloud_storage
          sendToRoutes: true
          throttleRatePerSec: 300
          conf:
            bucket: "'my-gcs-bucket'"
            path: "'data/'"
            authType: manual
            serviceAccountCredentials: "'{ \"type\": \"service_account\", \"project_id\":
              \"my-project\", \"private_key_id\": \"key123\" }'"
        pipelines:
          - csv-processing
        destinations:
          - bigquery
    CollectorExamplesDatabase:
      summary: Database Collector
      value:
        id: database-collector
        type: collection
        schedule:
          enabled: true
          cronSchedule: 0 2 * * *
          tz: UTC
          run:
            mode: run
            timeRangeType: relative
            earliest: -300
            expression: "true"
            logLevel: info
        collector:
          type: database
          sendToRoutes: true
          throttleRatePerSec: 50
          conf:
            connectionId: "'my-postgres-connection'"
            query: "`SELECT * FROM events WHERE created_at > '${earliest}'`"
        pipelines:
          - database-processing
        destinations:
          - postgres-output
    CollectorExamplesSplunk:
      summary: Splunk Collector
      value:
        id: splunk-collector
        type: collection
        schedule:
          enabled: true
          cronSchedule: 0 */1 * * *
          tz: UTC
          run:
            mode: run
            timeRangeType: relative
            earliest: -300
            expression: "true"
            logLevel: info
        collector:
          type: splunk
          sendToRoutes: true
          throttleRatePerSec: 1000
          conf:
            search: "'index=main sourcetype=syslog'"
            searchHead: "'https://splunk.example.com:8089'"
            endpoint: "'services/search/jobs/export'"
            authentication: basic
            username: "'admin'"
            password: "'changeme'"
            outputMode: json
        pipelines:
          - splunk-processing
        destinations:
          - splunk-output
    CollectorExamplesScript:
      summary: Script Collector
      value:
        id: script-collector
        type: collection
        schedule:
          enabled: true
          cronSchedule: 0 */3 * * *
          tz: UTC
          run:
            mode: run
            timeRangeType: relative
            earliest: -300
            expression: "true"
            logLevel: info
        collector:
          type: script
          sendToRoutes: true
          throttleRatePerSec: 10
          conf:
            discoverScript: "'/opt/scripts/discover.py'"
            collectScript: "'/opt/scripts/collect.py'"
        pipelines:
          - script-output-processing
        destinations:
          - file-output
    CollectorExamplesCriblLake:
      summary: Cribl Lake Dataset Collector (Cribl.Cloud only)
      value:
        id: cribl-lake-collector
        type: collection
        schedule:
          enabled: true
          cronSchedule: 0 */2 * * *
          tz: UTC
          run:
            mode: run
            timeRangeType: relative
            earliest: -300
            expression: "true"
            logLevel: info
        collector:
          type: cribl_lake
          sendToRoutes: true
          throttleRatePerSec: 1000
          conf:
            storageLocationId: cribl_lake
            dataset: cribl_logs
            query: "*"
            timeRange:
              start: -1h
              end: now
        pipelines:
          - lake-data-processing
        destinations:
          - analytics-platform
    CloneLookupExamplesCloneToDefaultPack:
      summary: Clone a Lookup to a Pack context
      description: Example request body for cloning a Lookup and its underlying Lookup
        file to the specified Pack context.
      value:
        newId: ip-reputation-copy.csv
        context:
          type: pack
          id: default
    CreateLookupFileExamplesCSVLookup:
      summary: Create a Lookup from a CSV file
      description: Example request body for creating a Lookup from a CSV file.
      value:
        id: ip-reputation.csv
        description: IP reputation Lookup table
        size: 128
    LookupFileInfoExamplesCancelUpload:
      summary: Cancel a lookup file upload
      description: Example request body for canceling an in-progress lookup file
        upload by referencing the temporary upload filename. You must also add
        <code>?cancel=true</code> (the <code>cancel</code> query parameter) to
        the request URL when you send the request.
      value:
        filename: temp_upload_12345.csv
    UpdateLookupFileExamplesUpdateLookup:
      summary: Update a Lookup
      description: Example request body for updating the description and size of an
        existing Lookup.<br/><br/>The request body must include a complete
        representation of the Lookup that you want to update. This endpoint does
        not support partial updates.
      value:
        id: ip-reputation.csv
        description: IP reputation Lookup
        size: 1024
    ParserExamplesCsvParser:
      summary: CSV Parser
      description: Example request body for creating a CSV Parser with predefined
        field names for comma-separated log data.
      value:
        id: csv-log-parser
        lib: custom
        description: Parser for CSV-formatted log data
        type: csv
        fields:
          - timestamp
          - level
          - source
          - message
    ParserExamplesJsonParser:
      summary: JSON Parser
      description: Example request body for creating a JSON Parser for automatically
        extracting fields from JSON-formatted events.
      value:
        id: json-event-parser
        lib: custom
        description: Parser for JSON-formatted events
        type: json
    ParserExamplesRegexParser:
      summary: Regex Parser
      description: Example request body for creating a regex-based Parser for
        extracting fields from syslog messages using regular expressions.
      value:
        id: syslog-regex-parser
        lib: custom
        description: Parser for syslog messages using regex extraction
        type: regex
    ParserExamplesGrokParser:
      summary: Grok Parser
      description: Example request body for creating a Grok Parser for extracting
        fields from Apache access logs using Grok patterns.
      value:
        id: apache-grok-parser
        lib: custom
        description: Parser for Apache access logs using Grok patterns
        type: grok
    RegexExamplesIpAddress:
      summary: IPv4 address pattern
      description: Example request body for creating a Regex Library entry that
        matches IPv4 addresses in log data with sample validation data.
      value:
        id: ipv4-address
        lib: custom
        regex: \b(?:\d{1,3}\.){3}\d{1,3}\b
        description: Regex Library entry that matches IPv4 addresses
        sampleData: Connection from 192.168.1.1 on port 8080
    RegexExamplesEmailAddress:
      summary: Email address pattern
      description: Example request body for creating a Regex Library entry that
        matches email addresses in text fields with sample validation data.
      value:
        id: email-address
        lib: custom
        regex: "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"
        description: Regex Library entry that matches email addresses
        sampleData: Contact user@example.com for details
    RegexExamplesHttpStatusCode:
      summary: HTTP status code pattern
      description: Example request body for creating a Regex Library entry that
        matches HTTP status codes (100-599) in access log data.
      value:
        id: http-status-code
        lib: custom
        regex: \b[1-5]\d{2}\b
        description: Regex Library entry that matches HTTP status codes
        sampleData: GET /api/data HTTP/1.1 200 OK
    SDSRuleExamplesCreditCard:
      summary: Credit card number detection
      description: Example request body for creating a sensitive data scanning (SDS)
        rule that detects credit card numbers using a regex pattern with context
        keyword matching for PCI compliance.
      value:
        id: credit-card-detection
        regex: \b(?:\d[ -]*?){13,16}\b
        description: Sensitive data scanning (SDS) rule that detects credit card numbers
          in event data
        rulesets:
          - pci-compliance
        contextKeywords:
          - keyword: card
            placement: before
    SDSRuleExamplesSocialSecurityNumber:
      summary: US Social Security number detection
      description: Example request body for creating a sensitive data scanning (SDS)
        rule that detects US Social Security numbers in the standard XXX-XX-XXXX
        format for PII detection.
      value:
        id: ssn-detection
        regex: \b\d{3}-\d{2}-\d{4}\b
        description: Sensitive data scanning (SDS) rule that detects US Social Security
          numbers in event data
        rulesets:
          - pii-detection
    SDSRuleExamplesEmailAddress:
      summary: Email address detection
      description: Example request body for creating a sensitive data scanning (SDS)
        rule that detects email addresses with context keywords for targeted PII
        detection.
      value:
        id: email-detection
        regex: "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"
        description: Sensitive data scanning (SDS) rule that detects email addresses in
          event data
        rulesets:
          - pii-detection
        contextKeywords:
          - keyword: email
            placement: before
          - keyword: mailto
            placement: before
    CreateSampleExamplesBasicSample:
      summary: Create a data sample
      description: Example request body for creating a new data sample file.
      value:
        id: syslog-sample.log
        sampleName: syslog-sample.log
        description: Sample syslog data for Pipeline config testing
    UpdateSampleExamplesUpdateSample:
      summary: Update a data sample
      description: Example request body for updating the description of an existing
        data sample.<br/><br/>The request body must include a complete
        representation of the sample that you want to update. This endpoint does
        not support partial updates.
      value:
        id: syslog-sample.log
        sampleName: syslog-sample.log
        description: Sample syslog data for testing production Pipelines
    AclApplyDashboardExamplesGrantAccess:
      summary: Grant a Dashboard policy to Members
      description: Example request body for granting a Dashboard policy to the
        specified Members.
      value:
        add:
          DashboardRead:
            - user1@example.com
            - user2@example.com
    AclApplyDashboardExamplesRevokeAccess:
      summary: Revoke a Dashboard policy from Members
      description: Example request body for revoking a Dashboard policy from the
        specified Members.
      value:
        rm:
          DashboardMaintain:
            - user3@example.com
    AclTeamsApplyDashboardExamplesGrantTeamAccess:
      summary: Grant a Dashboard policy to Teams
      description: Example request body for granting a Dashboard policy to the
        specified Teams.
      value:
        add:
          DashboardRead:
            - engineering-team
            - data-team
    AclTeamsApplyDashboardExamplesRevokeTeamAccess:
      summary: Revoke a Dashboard policy from Teams
      description: Example request body for revoking a Dashboard policy from the
        specified Teams.
      value:
        rm:
          DashboardMaintain:
            - former-team
    CreateDashboardExamplesSimpleDashboard:
      summary: Create a Dashboard with one Chart
      description: Example request body for creating a Dashboard with one Chart.
      value:
        id: search_activity_overview
        name: Search Activity Overview
        elements:
          - id: element_0
            type: chart.line
            title: Events over time
            layout:
              x: 0
              y: 0
              w: 12
              h: 4
            search:
              type: inline
              query: top 10 source | chart count() over _time by source
              earliest: -24h
              latest: now
    MoveDashboardExamplesMoveToPack:
      summary: Move a Dashboard to a Pack
      description: Example request body for moving a Dashboard to the specified Pack.
      value:
        context:
          type: pack
          id: my-pack
    MoveDashboardExamplesToGlobal:
      summary: Move a Dashboard to the global context
      description: Example request body for moving a Dashboard from a Pack to the
        global context by passing null as the context.
      value:
        context: null
    UpdateDashboardExamplesUpdateDashboard:
      summary: Update a Dashboard
      description: Example request body for updating an existing Dashboard to change
        the Dashboard name and add a raw events panel.<br/><br/>The request body
        must include a complete representation of the Dashboard that you want to
        update. This endpoint does not support partial updates.
      value:
        id: search_source_activity
        name: Search Source Activity and Logs
        elements:
          - id: element_0
            type: chart.line
            title: Events over time
            layout:
              x: 0
              y: 0
              w: 12
              h: 4
            search:
              type: inline
              query: top 10 source | chart count() over _time by source
              earliest: -24h
              latest: now
          - id: element_1
            type: list.events
            title: Raw Events
            layout:
              x: 0
              y: 4
              w: 12
              h: 4
            search:
              type: inline
              query: datatype=search_internal_logs
              earliest: -1h
              latest: now
    SearchMacroListResponseExamplesMinimal:
      summary: Single search Macro
      description: Example object representing one Macro in the response
        <code>items</code> array.
      value:
        id: all_events
        replacement: events
        created: 1700000000000
        modified: 1700000000000
        createdBy: jdoe
    SearchMacroCreateExamplesMinimal:
      summary: Create a search Macro with only required fields
      description: Example request body for creating a search Macro with only the
        required fields.
      value:
        id: all_events
        replacement: "true"
    SearchMacroCreateExamplesFull:
      summary: Create a search Macro with metadata
      description: Example request body for creating a search Macro with optional metadata.
      value:
        id: error_filter
        description: Filters to high-severity events.
        tags: errors,prod
        replacement: severity >= "Error"
    SearchMacroCreateExamplesParameterized:
      summary: Create a search Macro that uses numbered parameters
      description: Example request body for creating a search Macro that uses numbered
        parameter placeholders in <code>replacement</code>.
      value:
        id: host_filter
        description: Reusable host predicate with parameters.
        tags: hosts
        replacement: $1 | where host == $2
    MoveMacroContextExamplesIntoPack:
      summary: Move a search Macro to a Pack
      description: Example request body for moving a search Macro from the global
        context to a Pack.
      value:
        context:
          type: pack
          id: destination_pack
    MoveMacroContextExamplesToGlobal:
      summary: Move a search Macro to the global context
      description: Example request body for moving a search Macro from a Pack to the
        global context by passing null as the context.
      value:
        context: null
    SearchMacroUpdateExamplesMinimal:
      summary: Update replacement for a search Macro
      description: Example request body for updating the <code>replacement</code> KQL
        fragment for a search Macro.<br/><br/>The request body must include a
        complete representation of the Macro that you want to update. This
        endpoint does not support partial updates.
      value:
        id: error_filter
        replacement: severity in ("Error", "Critical")
    SearchMacroUpdateExamplesUpdateDefinition:
      summary: Update replacement and metadata for a search Macro
      description: Example request body for updating the <code>replacement</code> KQL
        fragment and metadata for a search Macro.<br/><br/>The request body must
        include a complete representation of the Macro that you want to update.
        This endpoint does not support partial updates.
      value:
        id: error_filter
        description: Filters to errors and warnings.
        tags: errors,warnings
        replacement: severity >= "Warning"
    AclApplyNotebookTemplateExamplesGrantAccess:
      summary: Grant a Notebook Template policy to Members
      description: Example request body for granting a Notebook Template policy to the
        specified Members.
      value:
        add:
          NotebookTemplateBase:
            - user1@example.com
            - user2@example.com
    AclApplyNotebookTemplateExamplesRevokeAccess:
      summary: Revoke a Notebook Template policy from Members
      description: Example request body for revoking a Notebook Template policy from
        the specified Members.
      value:
        rm:
          NotebookTemplateMaintain:
            - user3@example.com
    AclTeamsApplyNotebookTemplateExamplesGrantTeamAccess:
      summary: Grant a Notebook Template policy to Teams
      description: Example request body for granting a Notebook Template policy to the
        specified Teams.
      value:
        add:
          NotebookTemplateBase:
            - engineering-team
            - data-team
    AclTeamsApplyNotebookTemplateExamplesRevokeTeamAccess:
      summary: Revoke a Notebook Template policy from Teams
      description: Example request body for revoking a Notebook Template policy from
        the specified Teams.
      value:
        rm:
          NotebookTemplateMaintain:
            - former-team
    CreateNotebookTemplateExamplesSimpleTemplate:
      summary: Create a Notebook template with one Chart section
      description: Example request body for creating a Notebook template with one
        Chart visualization section.
      value:
        id: error_investigation_template
        info:
          name: Error Investigation Template
        sections:
          - id: section_0
            type: chart.column
            variant: chart
            title: Errors by source
            info:
              title: Errors by source
              created: 1714000000000
              createdBy: admin
              modified: 1714000000000
            search:
              type: inline
              query: error OR fail | chart count() by source
              earliest: -24h
              latest: now
        tokens: []
    UpdateNotebookTemplateExamplesUpdateTemplate:
      summary: Update a Notebook template
      description: Example request body for updating an existing Notebook
        template.<br/><br/>The request body must include a complete
        representation of the Notebook template that you want to update. This
        endpoint does not support partial updates.
      value:
        id: error_investigation_template
        info:
          name: Error Investigation Template
        sections:
          - id: section_0
            type: chart.column
            variant: chart
            title: Errors by source - Updated
            info:
              title: Errors by source - Updated
              created: 1714000000000
              createdBy: admin
              modified: 1714003600000
            search:
              type: inline
              query: error OR fail | chart count() by source
              earliest: -24h
              latest: now
        tokens: []
    SavedQueryCreateExamplesMinimal:
      summary: Create a saved search with only required fields
      description: Example request body for creating a saved search with only the
        required fields.
      value:
        id: saved_sample_logs
        name: Sample logs query
        query: dataset="sample_logs" | limit 100
    SavedQueryCreateExamplesWithTimeRangeAndDescription:
      summary: Create a saved search with description and time bounds
      description: Example request body for creating a saved search with a description
        and <code>earliest</code> and <code>latest</code> time bounds.
      value:
        id: saved_winlog_errors
        name: Windows security errors
        description: Saved search for recent Windows security channel errors.
        query: dataset="windows_events" | limit 200
        earliest: -24h
        latest: now
        isPrivate: true
    SavedQueryCreateExamplesWithSchedule:
      summary: Create a saved search with a daily schedule
      description: Example request body for creating a saved search with a cron
        schedule and retention settings.
      value:
        id: saved_daily_health
        name: Daily health check
        query: dataset="sample_logs" | summarize count() by host | limit 50
        schedule:
          enabled: true
          cronSchedule: 0 7 * * *
          tz: America/Los_Angeles
          keepLastN: 7
    MoveSavedQueryContextExamplesIntoPack:
      summary: Move a saved search to a Pack
      description: Example request body for moving a saved search from the global
        context to a Pack.
      value:
        context:
          type: pack
          id: destination_pack
    MoveSavedQueryContextExamplesToGlobal:
      summary: Move a saved search to the global context
      description: Example request body for moving a saved search from a Pack to the
        global context by passing null as the context.
      value:
        context: null
    SavedQueryUpdateExamplesFull:
      summary: Update a saved search
      description: Example request body for updating a saved search with a
        description, time window, and schedule.<br/><br/>The request body must
        include a complete representation of the saved search that you want to
        update. This endpoint does not support partial updates.
      value:
        id: saved_daily_health
        name: Daily health check
        description: Runs each morning to sample host counts.
        query: dataset="sample_logs" | summarize count() by host | limit 50
        earliest: -7d
        latest: now
        isPrivate: false
        schedule:
          enabled: true
          cronSchedule: 0 8 * * *
          tz: UTC
          keepLastN: 10
    SavedQueryUpdateExamplesTogglePrivacy:
      summary: Update a saved search to change only visibility
      description: Example request body for updating a saved search to change only the
        <code>isPrivate</code> setting.<br/><br/>The request body must include a
        complete representation of the saved search that you want to update.
        This endpoint does not support partial updates.
      value:
        id: saved_sample_logs
        name: Sample logs query
        query: dataset="sample_logs" | limit 100
        isPrivate: false
    SavedQueryNotificationResponseExamplesEmail:
      summary: Email Notification for a saved search
      description: Example object representing an email Notification for a saved search.
      value:
        id: notification_saved_search_email
        condition: search
        targets:
          - smtp_alerts_target
        targetConfigs:
          - id: smtp_alerts_target
            conf:
              subject: Saved search results
              body: Your saved search finished running.
              emailRecipient:
                to: alerts@example.com
        conf:
          savedQueryId: saved_sample_logs
        group: default_search
        user: jdoe@example.com
    SavedQueryNotificationCreateExamplesEmail:
      summary: Create an email Notification for a saved search
      description: Example request body for creating an email Notification for a saved
        search. The <code>conf.savedQueryId</code> must match the path parameter
        in the request URL.
      value:
        id: notification_saved_search_email
        condition: search
        targets:
          - smtp_alerts_target
        targetConfigs:
          - id: smtp_alerts_target
            conf:
              subject: Saved search results
              body: Your saved search finished running.
              emailRecipient:
                to: alerts@example.com
        conf:
          savedQueryId: saved_sample_logs
    SavedQueryNotificationUpdateExamplesPartial:
      summary: Update a Notification to change the Notification target
      description: Example request body for updating the Notification for a saved
        search to change the Notification target. The <code>id</code> and
        <code>conf.savedQueryId</code> must match the path parameters in the
        request URL.
      value:
        id: notification_saved_search_email
        condition: search
        targets:
          - smtp_alerts_secondary
        targetConfigs:
          - id: smtp_alerts_secondary
            conf:
              subject: Saved search results (backup route)
              body: Your saved search finished running.
              emailRecipient:
                to: oncall@example.com
        conf:
          savedQueryId: saved_sample_logs
    SearchJobCreateResponseExamplesSyntheticCompleted:
      summary: Completed search job
      description: Example response body for a completed search job.
      value:
        query: dataset="acme_app_events" | where severity <= 3 | limit 250
        earliest: -4h
        latest: now
        sampleRate: 1
        timezone: Europe/Berlin
        chartConfig:
          shouldApplyUserChartSettings: false
        tableConfig:
          columnSortSettings:
            sort: {}
          columnFilterSettings:
            contains: {}
          columnFormatSettings:
            prefix: {}
            suffix: {}
            precision: {}
            palette: {}
            preset: {}
          columnOrderSettings:
            order: {}
          rowNumberColumnWidth: 48
          showColumnTotals: false
          showColumnTotalsPinned: true
          showRowNumbers: false
          showRowTotals: false
          showRowTotalsPinned: true
          splitterSize: 33.333333333333336%
          wrapCells: false
        user: auth0|deadbeef00112233445566778899aa
        displayUsername: jdoe
        userDetails:
          username: auth0|deadbeef00112233445566778899aa
          displayUsername: jdoe
          email: jdoe@example.invalid
          roles:
            - power
          ssoGroups:
            - analytics
          type: user
        isPrivate: false
        group: default_search
        id: 1700000000456.Qw8sRtY
        timeCreated: 1700000000000
        setOptions: {}
        stages:
          - id: root
            subQueryText: dataset="acme_app_events" | where severity <= 3 | limit 250
            dependencies: []
            filter: ((dataset == 'acme_app_events') && (severity <= 3))
            resolvedDatasetIds:
              - acme_app_events
            searchConfig:
              pipelines:
                Federated:
                  id: root
                  conf:
                    asyncFuncTimeout: 1000
                    description: Pipeline, generated from Kalipso query
                    functions:
                      - id: drop
                        conf: {}
                        description: dataset="acme_app_events" | where severity <= 3 | limit 250
                        filter: "!((dataset == 'acme_app_events') && (severity <= 3))"
                        disabled: false
                        final: false
                Coordinated:
                  id: root
                  conf:
                    asyncFuncTimeout: 1000
                    description: Pipeline, generated from Kalipso query
                    functions: []
                Combined:
                  id: root
                  conf:
                    asyncFuncTimeout: 1000
                    description: Pipeline, generated from Kalipso query
                    functions:
                      - id: drop
                        conf: {}
                        description: dataset="acme_app_events" | where severity <= 3 | limit 250
                        filter: "!((dataset == 'acme_app_events') && (severity <= 3))"
                        disabled: false
                        final: false
              logicalPlans:
                Federated:
                  root:0:k9Xm:
                    - condition:
                        operator: and
                        lhs:
                          operator: ==
                          lhs:
                            columnPath:
                              - dataset
                            type: identifier
                          rhs:
                            literal: acme_app_events
                            type: literal
                          caseSensitive: false
                          type: binaryOperation
                        rhs:
                          operator: <=
                          lhs:
                            columnPath:
                              - severity
                            type: identifier
                          rhs:
                            literal: 3
                            type: literal
                          caseSensitive: false
                          type: binaryOperation
                        type: binaryOperation
                      type: filter
                Coordinated: {}
                Combined:
                  root:0:k9Xm:
                    - condition:
                        operator: and
                        lhs:
                          operator: ==
                          lhs:
                            columnPath:
                              - dataset
                            type: identifier
                          rhs:
                            literal: acme_app_events
                            type: literal
                          caseSensitive: false
                          type: binaryOperation
                        rhs:
                          operator: <=
                          lhs:
                            columnPath:
                              - severity
                            type: identifier
                          rhs:
                            literal: 3
                            type: literal
                          caseSensitive: false
                          type: binaryOperation
                        type: binaryOperation
                      type: filter
              datasets:
                - acme_app_events
              searchTerms: []
              useFormattedVisualization: false
              orderedFieldNames: []
              referencedColumnPaths:
                - - dataset
                - - severity
              hasSendOperator: false
              canComputeMetadataDistributively: false
            status: completed
            searchVersionByDatasetId: {}
            cacheStatusByDatasetId:
              acme_app_events:
                usedCache: false
                cacheStatus: miss
                reason: Not a Lake Dataset
                computeType: v1
        type: standard
        timeStarted: 1700000000150
        timeCompleted: 1700000002800
        status: completed
        earliestEpoch: 1699985600000
        latestEpoch: 1700000000000
    SearchJobCreateExamplesMinimal:
      summary: Create a search job with only a query string
      description: Example request body for creating a search job with only the
        required <code>query</code> field.
      value:
        query: dataset="sample_logs"
    SearchJobCreateExamplesWithTimeRange:
      summary: Create a search job with a relative time range
      description: Example request body for creating a search job with a relative time
        range using <code>earliest</code> and <code>latest</code>.
      value:
        query: dataset="sample_logs" | limit 100
        earliest: -24h
        latest: now
        timezone: America/New_York
        isPrivate: true
        sampleRate: 1
    SearchJobCreateExamplesEventContext:
      summary: Create a search job anchored on a specific event time
      description: Example request body for creating a search job that uses
        <code>numEventsBefore</code>, <code>numEventsAfter</code>, and
        <code>targetEventTime</code> to specify event time without a time range.
      value:
        query: dataset="sample_logs" | limit 1
        numEventsBefore: 50
        numEventsAfter: 50
        targetEventTime: 1712534400000
    SearchJobListResponseExamplesFullJobRow:
      summary: Get a sample search job
      description: Example response for getting a sample search job.
      value:
        id: 1700000000456.Qw8sRtY
        type: standard
        query: dataset="acme_app_events" | limit 10
        earliest: -1h
        latest: now
        timezone: UTC
        user: auth0|deadbeef00112233445566778899aa
        displayUsername: jdoe
        group: wg-east-search
        timeCreated: 1700000000000
        timeStarted: 1700000000120
        timeCompleted: 1700000000900
        status: completed
        isPrivate: false
        setOptions: {}
    SearchJobUpdateExamplesCancel:
      summary: Cancel a search job
      description: Example request body for canceling a search job.
      value:
        status: canceled
    SearchJobUpdateExamplesMakeResultsPublic:
      summary: Update a search job to make results visible to job group members
      description: Example request body for updating a search job by setting
        <code>isPrivate</code> to <code>false</code>, so that results follow the
        job <code>group</code> visibility rules instead of owner-only access.
      value:
        isPrivate: false
    SearchJobCancelResponseExamplesCanceled:
      summary: Single search job after cancellation
      description: Example object representing a search job after cancellation.
      value:
        id: 1700000000456.Qw8sRtY
        type: standard
        query: dataset="acme_app_events" | limit 10
        earliest: -1h
        latest: now
        timezone: UTC
        user: auth0|deadbeef00112233445566778899aa
        displayUsername: jdoe
        group: wg-east-search
        timeCreated: 1700000000000
        timeStarted: 1700000000120
        timeCompleted: 1700000000400
        status: canceled
        isPrivate: false
        setOptions: {}
    SearchJobStatusResponseExamplesRunning:
      summary: Show search job status while running
      description: Example response for showing search job status while the job is in
        progress, including cache and compute node.
      value:
        status: running
        timeCreated: 1700000000000
        timeStarted: 1700000000500
        timeNow: 1700000001200
        pendingComputeNodeStatuses:
          countWarm: 2
          countCold: 0
        cacheStatusesByStageId:
          root:
            acme_app_events:
              usedCache: true
              computeType: v2
    SearchJobSettingsExamplesExtendRetention:
      summary: Save search job settings with extended reaper retention
      description: Example request body for saving search job settings with extended
        reaper retention.
      value:
        reaperKeepUntil: 1893456000000
    CreateBannerExamplesCustomBanner:
      summary: Create a banner
      description: Example request body for creating a custom banner with a blue theme
        and message about maintenance that is enabled for all users.
      value:
        id: custom-banner
        enabled: true
        theme: blue
        message: System maintenance scheduled for tonight at 10 PM.
        type: custom
    UpdateBannerExamplesUpdateBannerMessage:
      summary: Update a banner
      description: Example request body for updating an existing custom banner to
        change the theme to orange and change the message text.<br/><br/>The
        request body must include a complete representation of the Banner that
        you want to update. This endpoint does not support partial updates.
      value:
        id: custom-banner
        enabled: true
        theme: orange
        message: System maintenance in progress. Services may be temporarily
          unavailable.
        type: custom
        link: https://status.example.com
        linkDisplay: Status Page
    CreateCertificateExamplesSelfSignedCert:
      summary: Create a Certificate with PEM-formatted Certificate and private key
      description: Example request body for creating a Certificate by providing the
        Certificate and its private key in PEM format.
      value:
        id: my-cert
        cert: |-
          -----BEGIN CERTIFICATE-----
          MIIBxTCCAWugAwIBAgIUE...
          -----END CERTIFICATE-----
        privKey: |-
          -----BEGIN PRIVATE KEY-----
          MIIEvQIBADANBgkqhki...
          -----END PRIVATE KEY-----
    UpdateCertificateExamplesUpdateCert:
      summary: Add a CA chain to a Certificate
      description: Example request body for adding a Certificate Authority (CA)
        certificate chain to an existing Certificate.<br/><br/>The request body
        must include a complete representation of the Certificate that you want
        to update. This endpoint does not support partial updates.
      value:
        id: my-cert
        description: Production TLS certificate
        cert: |-
          -----BEGIN CERTIFICATE-----
          MIIBxTCCAWugAwIBAgIUE...
          -----END CERTIFICATE-----
        privKey: |-
          -----BEGIN PRIVATE KEY-----
          MIIEvQIBADANBgkqhki...
          -----END PRIVATE KEY-----
        ca: |-
          -----BEGIN CERTIFICATE-----
          MIIBxTCCAWugAwIBAgIUA...
          -----END CERTIFICATE-----
          -----BEGIN CERTIFICATE-----
          nMIIBxTCCAWugAwIBAgIUB...
          -----END CERTIFICATE-----
    CreateGlobalSecretExamplesCriblBackedCredentialsSecret:
      summary: Create a credentials global secret in the Cribl-managed store
      description: Example request body for creating a global secret for a username
        and password pair in the Cribl-managed secret store.
      value:
        id: finance-db
        secretType: credentials
        description: Database credentials for finance reporting
        plaintextFields:
          username: admin
        secretValues:
          password: Sup3rS3cret!
    UpdateGlobalSecretExamplesCriblBackedCredentialsSecret:
      summary: Rotate a credentials global secret in the Cribl-managed store
      description: Example request body for rotating the password of an existing
        credentials global secret.<br/><br/>The request body must include a
        complete representation of the global secret that you want to update.
        This endpoint does not support partial updates.
      value:
        id: finance-db
        secretType: credentials
        plaintextFields:
          username: admin
        secretValues:
          password: N3wSup3rS3cret!
    AclApplyGroupExamplesGrantAccess:
      summary: Grant a Group policy to Members
      description: Example request body for granting a Group policy to the specified
        Members.
      value:
        add:
          GroupRead:
            - user1@example.com
            - user2@example.com
    AclApplyGroupExamplesRevokeAccess:
      summary: Revoke a Group policy from Members
      description: Example request body for revoking a Group policy from the specified
        Members.
      value:
        rm:
          GroupFull:
            - user3@example.com
    AclTeamsApplyGroupExamplesGrantTeamAccess:
      summary: Grant a Group policy to Teams
      description: Example request body for granting a Group policy to the specified Teams.
      value:
        add:
          GroupRead:
            - engineering-team
            - data-team
    AclTeamsApplyGroupExamplesRevokeTeamAccess:
      summary: Revoke a Group policy from Teams
      description: Example request body for revoking a Group policy from the specified
        Teams.
      value:
        rm:
          GroupFull:
            - former-team
    CreateGroupExamplesCloudWg:
      summary: Create a Worker Group in Cribl.Cloud
      description: Example request body for creating a Worker Group on Cribl.Cloud
        sized for a low-ingest deployment.
      value:
        id: goatCloudIanWg
        name: goatcloudianwg
        cloud:
          provider: aws
          region: us-west-2
        workerRemoteAccess: true
        type: stream
        onPrem: false
        estimatedIngestRate: 2048
        provisioned: true
    CreateGroupExamplesOnPremWg:
      summary: Create a Worker Group in customer-managed deployment
      value:
        id: goatOnPremIanWg
        name: goatonpremianwg
        description: Worker group in customer-managed deployment
        workerRemoteAccess: true
        type: stream
        onPrem: true
    CreateGroupExamplesCloneWg:
      summary: Clone an on-prem Worker Group
      value:
        id: goatOnPremDollyWg
        name: goatonpremdollywg
        description: Worker Group cloned from goatOnPremIanWg with identical configuration
        workerRemoteAccess: true
        type: stream
        onPrem: true
        sourceGroupId: goatOnPremIanWg
    CreateGroupExamplesEdgeFleet:
      summary: Create Edge Fleet
      value:
        id: goatIanEdgeFleet
        name: goatianedgefleet
        description: Create a new Edge Fleet
        workerRemoteAccess: true
        type: edge
        onPrem: true
    UpdateGroupExamplesScaleCloudWorkerGroup:
      summary: Scale a Cribl.Cloud Worker Group by updating estimated ingest rate
      description: Example request body for scaling a Cribl.Cloud Worker Group to
        handle higher throughput.<br/><br/>The request body must include a
        complete representation of the Group or Fleet that you want to update.
        This endpoint does not support partial updates.
      value:
        id: goatCloudIanWg
        name: goatcloudianwg
        description: Scaled Worker Group with estimated ingest rate of 4096 (48 MB/s, 21
          Worker Processes) for increased capacity
        cloud:
          provider: aws
          region: us-west-2
        workerRemoteAccess: true
        type: stream
        onPrem: false
        estimatedIngestRate: 4096
        provisioned: true
        configVersion: abc1234
        workerCount: 3
        incompatibleWorkerCount: 0
        deployingWorkerCount: 0
        lookupDeployments: []
    UpdateGroupExamplesUpdateOnPremWorkerGroup:
      summary: Update a customer-managed Worker Group
      description: Example request body for updating a customer-managed Worker
        Group.<br/><br/>The request body must include a complete representation
        of the Group or Fleet that you want to update. This endpoint does not
        support partial updates.
      value:
        id: goatOnPremIanWg
        name: goatonpremianwg
        description: Updated customer-managed Worker Group with remote access enabled
        workerRemoteAccess: true
        type: stream
        onPrem: true
        configVersion: abc1234
        workerCount: 5
        incompatibleWorkerCount: 0
        deployingWorkerCount: 0
        lookupDeployments: []
    CreateKeyExamplesAESKey:
      summary: Create an encryption key
      description: Example request body for creating an encryption key for local
        symmetric encryption.
      value:
        keyId: my-encryption-key
        algorithm: aes-256-cbc
        kms: local
        useIV: true
        keyclass: 0
        created: 1700000000
        expires: 1800000000
        description: Production encryption key
    UpdateKeyExamplesUpdateKey:
      summary: Update an encryption key
      description: Example request body for updating an existing encryption key to
        extend its expiration.<br/><br/>The request body must include a complete
        representation of the encryption key that you want to update. This
        endpoint does not support partial updates.
      value:
        keyId: my-encryption-key
        algorithm: aes-256-cbc
        kms: local
        useIV: true
        keyclass: 0
        created: 1700000000
        expires: 1900000000
        description: Production encryption key
    MappingRulesetActivateExamplesActivate:
      summary: Activate the default Mapping Ruleset
      value:
        id: default
    MappingRulesetCreateExamplesOSBasedMapping:
      summary: Map Edge Nodes based on their Operating System (Linux, Win32, macOS)
      value:
        id: os-based-mapping
        conf:
          functions:
            - filter: platform === "linux"
              id: eval
              description: Map Linux Edge Nodes
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'linux_fleet'"
            - filter: platform === "win32"
              id: eval
              description: Map Windows Edge Nodes
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'windows_fleet'"
            - filter: platform === "darwin"
              id: eval
              description: Map macOS Edge Nodes
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'macos_fleet'"
            - filter: "!cribl.group"
              id: eval
              description: Default mapping for unmapped nodes
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'default_fleet'"
    MappingRulesetCreateExamplesTagBasedMapping:
      summary: Map Edge Nodes using cribl.tags
      value:
        id: tag-based-mapping
        conf:
          functions:
            - filter: cribl.tags.includes("WinLaptop")
              id: eval
              description: Map Windows Laptop Edge Nodes
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'laptop_fleet'"
            - filter: cribl.tags.includes("Production")
              id: eval
              description: Map Production Edge Nodes
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'production_fleet'"
            - filter: "!cribl.group"
              id: eval
              description: Default mapping
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'default_fleet'"
    MappingRulesetCreateExamplesOutpostBasedMapping:
      summary: Map Edge Nodes connected to a specific Outpost ID or hostname
      value:
        id: outpost-mapping
        conf:
          functions:
            - filter: outpost.host === "5ab6c676be6a"
              id: eval
              description: Map Edge Nodes from Outpost A
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'outpost_a_fleet'"
            - filter: outpost.guid === "550e8400-e29b-41d4-a716-446655440000"
              id: eval
              description: Map Edge Nodes from Outpost B by GUID
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'outpost_b_fleet'"
            - filter: "!cribl.group"
              id: eval
              description: Default mapping
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'default_fleet'"
    MappingRulesetCreateExamplesComplexMapping:
      summary: Map Edge Nodes using complex filters based on IP, CPU, memory, and
        environment
      value:
        id: complex-mapping
        conf:
          functions:
            - filter: (conn_ip.startsWith("10.10.42.") && cpus > 6) ||
                env.CRIBL_HOME.match("DMZ")
              id: eval
              description: Map high-performance nodes in specific network or DMZ
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'high_perf_fleet'"
            - filter: platform === "linux" && memory > 16000 &&
                cribl.tags.includes("Database")
              id: eval
              description: Map Linux nodes with high memory for database workloads
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'database_fleet'"
            - filter: "!cribl.group"
              id: eval
              description: Default mapping
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'default_fleet'"
    MappingRulesetCreateExamplesAWSEC2InstanceMapping:
      summary: Map Edge Nodes using AWS EC2 instance tags
      value:
        id: aws-ec2-mapping
        conf:
          functions:
            - filter: aws?.tags?.Environment === "Production"
              id: eval
              description: Map Production EC2 instances
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'aws_prod_fleet'"
            - filter: aws?.tags?.Team === "DevOps"
              id: eval
              description: Map DevOps team EC2 instances
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'devops_fleet'"
            - filter: "!cribl.group"
              id: eval
              description: Default mapping
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'default_fleet'"
    MappingRulesetCreateExamplesContainerBasedMapping:
      summary: Map Edge Nodes running in containers based on host characteristics
      value:
        id: container-mapping
        conf:
          functions:
            - filter: hostOs?.platform === "linux" && hostOs?.cpu_count > 4
              id: eval
              description: Map containerized nodes on high-CPU Linux hosts
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'container_high_cpu_fleet'"
            - filter: hostOs?.id
              id: eval
              description: Map all containerized Edge Nodes
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'container_fleet'"
            - filter: "!cribl.group"
              id: eval
              description: Default mapping for non-containerized nodes
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'default_fleet'"
    MappingRulesetCreateExamplesDefaultRuleset:
      summary: Routes all unmapped Edge Nodes to the default_fleet
      value:
        id: simple-default-mappings
        conf:
          functions:
            - filter: "!cribl.group"
              id: eval
              description: Simple default Mapping Ruleset
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'default_fleet'"
    MappingRulesetUpdateExamplesUpdateComplexRule:
      summary: Modify an existing ruleset with a complex, multi-condition filter
      description: Example request body for modifying an existing Mapping Ruleset with
        a complex, multi-condition filter.<br/><br/>The request body must
        include a complete representation of the Mapping Ruleset that you want
        to update. This endpoint does not support partial updates.
      value:
        id: complex-mapping
        conf:
          functions:
            - filter: (conn_ip.startsWith("10.10.42.") && cpus > 6) ||
                env.CRIBL_HOME.match("DMZ")
              id: eval
              description: Map high-performance nodes in specific network or DMZ
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'high_perf_fleet'"
            - filter: "!cribl.group"
              id: eval
              description: Default mapping
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'default_fleet'"
    MappingRulesetUpdateExamplesEnableDisabledRule:
      summary: Change an existing ruleset flag to enable it
      description: Example request body for enabling an existing Mapping
        Ruleset.<br/><br/>The request body must include a complete
        representation of the Mapping Ruleset that you want to update. This
        endpoint does not support partial updates.
      value:
        id: default
        conf:
          functions:
            - filter: "!cribl.group"
              id: eval
              description: Default Mappings
              disabled: false
              final: true
              conf:
                add:
                  - name: groupId
                    value: "'default_fleet'"
        active: true
    CreateMessageExamplesInfoMessage:
      summary: Create an informational message
      description: Example request body for creating an informational message.
      value:
        id: scheduled-maintenance
        severity: info
        text: Scheduled maintenance window starts at 22:00 UTC.
        title: Scheduled Maintenance
    CreateMessageExamplesWarningMessage:
      summary: Create a warning message
      description: Example request body for creating a warning message.
      value:
        id: high-disk-usage
        severity: warn
        text: Disk usage exceeded 80% on Worker Node w0.
        title: High Disk Usage
    CreateNotificationExamplesHighVolumeSource:
      summary: Create a Source Notification for high data volume
      description: Example request body for creating a Source Notification that alerts
        if the total data ingested within the configured <code>timeWindow</code>
        exceeds the specified <code>dataVolume</code>.
      value:
        id: high-volume-http-src
        condition: high-volume
        targets:
          - system_notifications
        conf:
          name: in_http
          timeWindow: 60s
          dataVolume: 1GB
          notifyOnResolution: true
    CreateNotificationExamplesUnhealthyDestination:
      summary: Create a Destination Notification for an unhealthy Destination
      description: Example request body for creating a Destination Notification that
        alerts when the Destination has reported an unhealthy state for the
        specified <code>timeWindow</code>.
      value:
        id: unhealthy-splunk-dest
        condition: unhealthy-dest
        targets:
          - system_notifications
        conf:
          name: out_splunk
          timeWindow: 60s
          notifyOnResolution: true
    UpdateNotificationExamplesUpdateHighVolumeSource:
      summary: Update a Source Notification for high data volume
      description: Example request body for updating a Source Notification that alerts
        if the total data ingested within the configured <code>timeWindow</code>
        exceeds the specified <code>dataVolume</code>.<br/><br/>The request body
        must include a complete representation of the Notification that you want
        to update. This endpoint does not support partial updates.
      value:
        id: high-volume-http-src
        condition: high-volume
        targets:
          - system_notifications
        conf:
          name: in_http
          timeWindow: 120s
          dataVolume: 2GB
          notifyOnResolution: true
    CreateProvisioningTokenExamplesCreateStandardToken:
      summary: Create a provisioning token
      description: Example request body for creating a provisioning token that is
        scoped to managed-edge Nodes with a use limit and expiration.
      value:
        id: edge-retail-q1
        description: Retail Edge Fleet Q1 2026 deployment
        distMode: managed-edge
        useLimit: 500
        expiresAt: 1751241600000
    RevokeProvisioningTokenExamplesRevokeWithReason:
      summary: Revoke a provisioning token
      description: Example request body for revoking a provisioning token and
        recording the reason for revocation in the audit log.
      value:
        reason: Fleet decommissioned after Q1 2026 rollout
    UpdateProvisioningTokenExamplesUpdateTokenDescription:
      summary: Update a provisioning token
      description: Example request body for updating an existing provisioning token.
        All mutable fields are replaced. Pass null for nullable fields
        (distMode, useLimit, expiresAt) to clear them. description is optional
        and defaults to an empty string if omitted.
      value:
        description: Retail Edge Fleet — extended for Q2 2026
        distMode: managed-edge
        useLimit: 1000
        expiresAt: 1759017600000
    CreateRoleExamplesCustomRole:
      summary: Create a Role with assigned Policies
      description: Example request body for creating a custom Role with the Policy
        <code>collection-admin-policy</code> assigned.
      value:
        id: data-engineer
        policy:
          - collection-admin-policy
        description: Role for data engineering team members
    UpdateRoleExamplesUpdateRole:
      summary: Add Policies to an existing custom Role
      description: Example request body for adding the
        <code>pipeline-read-policy</code> to an existing custom
        Role.<br/><br/>The request body must include a complete representation
        of the Role that you want to update. This endpoint does not support
        partial updates.
      value:
        id: data-engineer
        policy:
          - collection-admin-policy
          - pipeline-read-policy
        description: Role for data engineers with collection admin and Pipeline read access
    CreateScriptExamplesShellScript:
      summary: Create a shell Script
      description: Example request body for creating a bash Script that cleans up old
        log files.
      value:
        id: cleanup-logs
        command: /bin/bash
        description: Clean up old log files
        args:
          - -c
          - find /var/log -name "*.log" -mtime +30 -delete
    UpdateScriptExamplesUpdateScript:
      summary: Update a Script
      description: Example request body for updating the arguments and description for
        an existing Script.<br/><br/>The request body must include a complete
        representation of the Script that you want to update. This endpoint does
        not support partial updates.
      value:
        id: cleanup-logs
        command: /bin/bash
        description: Clean up log files older than 60 days
        args:
          - -c
          - find /var/log -name "*.log" -mtime +60 -delete
    CreateSecretFolderExamplesCriblBackedFolder:
      summary: Create a secret folder
      description: Example request body for creating a secret folder backed by the
        built-in Cribl store.
      value:
        id: finance
        secretStoreId: cribl
        description: Shared credentials for finance systems
        sharing:
          groupIds:
            - default
          fleetIds:
            - "*"
    UpdateSecretFolderExamplesUpdateDescriptionAndSharing:
      summary: Update a secret folder
      description: Example request body for updating the description and sharing
        configuration for an existing secret folder.<br/><br/>The request body
        must include a complete representation of the secret folder that you
        want to update. This endpoint does not support partial updates.
      value:
        id: finance
        description: Shared authentication credentials for finance systems
        sharing:
          groupIds:
            - team-a
            - team-b
    CreateSecretStoreExamplesVaultSecretStore:
      summary: Create a secret store
      description: Example request body for creating a secret store.
      value:
        id: vault-prod
        type: vault
        description: Vault-backed secret store for production credentials
        config:
          address: https://vault.example.com:8200
          namespace: platform/team-a
    UpdateSecretStoreExamplesUpdateVaultSecretStore:
      summary: Update a secret store
      description: Example request body for updating the namespace of an existing
        secret store.<br/><br/>The request body must include a complete
        representation of the secret store that you want to update. This
        endpoint does not support partial updates.
      value:
        id: vault-prod
        description: Vault-backed secret store for production credentials
        config:
          address: https://vault.example.com:8200
          namespace: platform/team-b
    CreateTeamExamplesEngineeringTeam:
      summary: Create a Team with assigned Roles
      description: Example request body for creating a Team with assigned Roles.
      value:
        id: engineering
        name: Engineering
        description: Engineering team
        roles:
          - stream_admin
    UpdateTeamExamplesUpdateTeamRoles:
      summary: Update Team Roles
      description: Example request body for updating the Roles assigned to an existing
        Team.<br/><br/>The request body must include a complete representation
        of the Team that you want to update. This endpoint does not support
        partial updates.
      value:
        id: engineering
        name: Engineering
        description: Engineering team with expanded admin access on Workspace
        roles:
          - admin
    UpdateTeamUsersExamplesAddUsers:
      summary: Add Members to a Team
      description: Example request body for adding the specified Members to an
        existing Team.
      value:
        add:
          - idUser1
          - idUser2
    UpdateTeamUsersExamplesRemoveUsers:
      summary: Remove Members from a Team
      description: Example request body for removing the specified Members from an
        existing Team.
      value:
        rm:
          - idUser3
    CreateUserExamplesBasicUser:
      summary: Create a local user with an assigned Role
      description: Example request body for creating a new local user and assigning
        them a Role.
      value:
        id: jsmith
        username: jsmith
        first: John
        last: Smith
        email: jsmith@example.com
        password: secureP@ssw0rd
        disabled: false
        roles:
          - admin
    UpdateUserExamplesUpdateUserRoles:
      summary: Update email addres for a local user
      description: Example request body for updating the email address for an existing
        local user.<br/><br/>The request body must include a complete
        representation of the User that you want to update. This endpoint does
        not support partial updates.
      value:
        id: jsmith
        username: jsmith
        first: John
        last: Smith
        email: john.smith@example.com
        disabled: false
        roles:
          - admin
    UpdateUserInfoExamplesUpdateOwnProfile:
      summary: Update your Cribl password
      description: Example request body for updating your own Cribl password (and
        other user information, if needed).<br/><br/>The request body must
        include a complete representation of the User that you want to update.
        This endpoint does not support partial updates.
      value:
        id: jsmith
        username: jsmith
        first: John
        last: Smith
        email: john.smith@example.com
        disabled: false
        currentPassword: oldP@ssw0rd
        password: newP@ssw0rd
    LakeBucketCreateExamplesDdssBucket:
      summary: Create a Cribl Lake bucket
      description: Example request body for creating a Data Distribution Storage
        Service (DDSS) Cribl Lake bucket with an AWS IAM policy.
      value:
        id: my_ddss_bucket
        name: my_ddss_bucket
        type: ddss
        region: us-east-1
        retentionPeriodInDays: 36500
        credentials:
          method: auto
        policy:
          Statement:
            - Principal:
                AWS: arn:aws:iam::123456789012:role/SplunkAccessRole
              Action:
                - s3:PutObject
                - s3:GetObject
                - s3:ListBucket
                - s3:ListBucketVersions
                - s3:GetBucketLocation
    LakeBucketUpdateExamplesUpdateDescription:
      summary: Update the description of a Cribl Lake Bucket
      description: Example request body for updating the description of an existing
        Cribl Lake bucket. The request body must include a complete
        representation of the Cribl Lake bucket that you want to update,
        including read-only fields. This endpoint does not support partial
        updates.
      value:
        id: my_ddss_bucket
        name: my_ddss_bucket
        type: ddss
        region: us-east-1
        retentionPeriodInDays: 36500
        description: DDSS Cribl Lake bucket
        credentials:
          method: auto
    LakeDatasetBulkUpdateExamplesBulkUpdateRetention:
      summary: Bulk update the retention period for Lake Datasets
      description: "Example request body for updating the retention periods for the
        listed Lake Datasets in the Lake that is specified in the request
        URL.<br/><br/>The request body should include an array of objects: one
        object for each Lake Dataset to update. Each object in the array must
        include a Lake Dataset <code>id</code> and the fields to update for that
        Lake Dataset."
      value:
        id: web_access_logs
        retentionPeriodInDays: 180
    LakeDatasetBulkUpdateExamplesBulkUpdateDescription:
      summary: Bulk update the description and accelerated fields for Lake Datasets
      description: "Example request body for updating the description and accelerated
        fields for the listed Lake Datasets in the Lake that is specified in the
        request URL.<br/><br/>The request body should include an array of
        objects: one object for each Lake Dataset to update. Each object in the
        array must include a Lake Dataset <code>id</code> and the fields to
        update for that Lake Dataset."
      value:
        id: security_events
        description: Updated security events
        acceleratedFields:
          - host
          - source
          - status
    LakeDatasetCreateExamplesJsonDataset:
      summary: Create a Lake Dataset in JSON format
      description: Example request body for creating a Lake Dataset in JSON format
        with a 90-day retention period.
      value:
        id: web_access_logs
        description: Web server access logs
        storageLocationId: my-storage-location
        format: json
        retentionPeriodInDays: 90
        acceleratedFields:
          - host
          - status
    LakeDatasetCreateExamplesParquetDataset:
      summary: Create a Lake Dataset in Parquet format
      description: Example request body for creating a Lake Dataset in Parquet format
        with a 365-day retention period and search configuration.
      value:
        id: security_events
        description: Security event data in Parquet format
        storageLocationId: my-storage-location
        format: parquet
        retentionPeriodInDays: 365
        searchConfig:
          datatypes:
            - palo_alto_firewall
            - crowdstrike_fdr
    LakeDatasetCreateExamplesMinimalDataset:
      summary: Create a minimal Lake Dataset
      description: Example request body for creating a Lake Dataset with only the
        required body parameters.
      value:
        id: app_logs
    LakeDatasetUpdateExamplesUpdateRetention:
      summary: Update the retention period for a Lake Dataset
      description: Example request body for updating the retention period for an
        existing Lake Dataset.
      value:
        retentionPeriodInDays: 180
    LakeDatasetUpdateExamplesUpdateDescription:
      summary: Update description and accelerated fields for a Lake Dataset
      description: Example request body for updating the description and accelerated
        fields for an existing Lake Dataset.
      value:
        description: Web server access logs with accelerated fields.
        acceleratedFields:
          - host
          - status
          - source
    LakeDirectAccessCreateExamplesNdjsonToken:
      summary: Create a Direct Access HTTP Source for NDJSON ingest
      description: Example request body for creating a Direct Access HTTP Source for
        NDJSON ingest in Cribl Lake.
      value:
        id: default
        authTokens:
          - token: my_ingest_token_001
            description: Primary ingest token for NDJSON data
    LakeDirectAccessCreateExamplesHecToken:
      summary: Create a Direct Access HTTP Source for Splunk HEC ingest
      description: Example request body for creating a Direct Access HTTP Source for
        Splunk HEC ingest in Cribl Lake.
      value:
        id: default
        authTokens:
          - token: hec_token_001
            description: Splunk HEC ingest token
            splunkHecMetadata:
              enabled: true
              defaultDataset: web_access_logs
    LakeDirectAccessUpdateExamplesUpdateAuthTokens:
      summary: Update the authentication token for a Direct Access HTTP Source
      description: Example request body for updating the authentication token for an
        existing Direct Access HTTP Source for NDJSON ingest in Cribl Lake.
      value:
        id: default
        authTokens:
          - token: updated_ingest_token
            description: Rotated ingest token for NDJSON data
    LakeStorageLocationCreateExamplesAwsS3WithAutoCredentials:
      summary: Create an AWS S3 Storage Location with auto credentials
      description: Example request body for creating an AWS S3 Storage Location using
        automatic credential resolution (instance role).
      value:
        id: us-east-1-primary
        description: Primary Storage Location in US East.
        provider: aws-s3
        config:
          region: us-east-1
          bucketName: cribl-lake-data-us-east-1
        credentials:
          method: auto
    LakeStorageLocationCreateExamplesAwsS3WithManualCredentials:
      summary: Create an AWS S3 Storage Location with manual credentials
      description: Example request body for creating an AWS S3 Storage Location using
        explicit IAM credentials and a specified role to assume.
      value:
        id: us-west-2-analytics
        description: Analytics Storage Location in US West
        provider: aws-s3
        config:
          region: us-west-2
          bucketName: cribl-lake-analytics-us-west-2
          encryption: SSE-S3
        credentials:
          method: manual
          apiKey: AKIAIOSFODNN7EXAMPLE
          secretKey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
          roleToAssume: arn:aws:iam::123456789012:role/CriblLakeAccess
    LakeStorageLocationCreateExamplesAzureBlob:
      summary: Create an Azure Blob Storage Location
      description: Example request body for creating an Azure Blob Storage Location
        with tenant credentials.
      value:
        id: azure-eastus-primary
        description: Primary Storage Location in East US
        provider: azure_blob
        config:
          region: eastus
        credentials:
          method: auto
          tenantId: 72f988bf-86f1-41af-91ab-2d7cd011db47
    LakeStorageLocationUpdateExamplesUpdateCredentials:
      summary: Update Storage Location credentials
      description: Example request body for updating the credentials for an existing
        Storage Location.
      value:
        credentials:
          method: manual
          apiKey: AKIAIOSFODNN7EXAMPLE
          secretKey: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
    LakeStorageLocationUpdateExamplesUpdateDescription:
      summary: Update Storage Location description
      description: Example request body for updating the description for an existing
        Storage Location.
      value:
        description: Primary Storage Location
    CreateDashboardCategoryExamplesSimpleCategory:
      summary: Create a Dashboard Collection
      description: Example request body for creating a Dashboard Collection to
        organize related Dashboards.
      value:
        id: infrastructure
        name: Infrastructure
        description: Dashboards for infrastructure monitoring and health checks.
    UpdateDashboardCategoryExamplesUpdateCategory:
      summary: Update a Dashboard Collection
      description: Example request body for updating the name and description of an
        existing Dashboard Collection.
      value:
        id: infrastructure
        name: Infrastructure & Cloud
        description: Dashboards for infrastructure monitoring, cloud services, and
          health checks.
    DatatypeListResponseExamplesNdjsonRow:
      summary: Get a sample Datatype
      description: Example response for getting a sample Datatype in the
        <code>items</code> array.
      value:
        id: app_ndjson_logs
        lib: custom
        dataFormat: ndjson
        automaticExtraction:
          extractionType: json
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeCreateExamplesMinimalNdjson:
      summary: Create an NDJSON Datatype with automatic timestamping
      description: Example request body for creating an NDJSON Datatype with automatic
        field extraction and timestamp detection.
      value:
        id: app_ndjson_logs
        lib: custom
        dataFormat: ndjson
        automaticExtraction:
          extractionType: json
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeCreateExamplesNdjsonManualTimestamp:
      summary: Create an NDJSON Datatype with a manual timestamp extraction
      description: Example request body for creating an NDJSON Datatype with manual
        timestamp extraction for non-standard timestamp formats.
      value:
        id: app_ndjson_iso8601
        lib: custom
        dataFormat: ndjson
        automaticExtraction:
          extractionType: json
        timestampExtraction:
          type: manual
          format: "%Y-%m-%dT%H:%M:%S"
          sourceField: timestamp
          timezone: UTC
    DatatypeCreateExamplesNdjsonWithAdditionalExtraction:
      summary: Create an NDJSON Datatype with additional regex extraction
      description: Example request body for creating an NDJSON Datatype with an
        additional regex extraction applied after the primary JSON parse.
      value:
        id: app_ndjson_with_extras
        lib: custom
        dataFormat: ndjson
        automaticExtraction:
          extractionType: json
        additionalExtractions:
          - name: parse_request_line
            sourceField: request
            extractionType: regexp
            regexpList:
              - regexp: (?P<method>\w+)\s+(?P<path>[^\s]+)\s+HTTP/(?P<http_version>[\d.]+)
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeCreateExamplesJsonArray:
      summary: Create a JSON array Datatype
      description: Example request body for creating a Datatype for files containing a
        top-level JSON array of objects rather than one JSON object per line.
      value:
        id: api_response_json_array
        lib: custom
        dataFormat: json_array
        automaticExtraction:
          extractionType: json
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeCreateExamplesRawOpaque:
      summary: Create a raw Datatype with no field extraction
      description: Example request body for creating a raw Datatype where the
        <code>_raw</code> field is left as-is with no automatic field
        extraction. Use for syslog-style data where parsing happens downstream.
      value:
        id: syslog_raw
        lib: custom
        dataFormat: raw
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeCreateExamplesKvpSpaceEquals:
      summary: Create a key-value pair Datatype
      description: Example request body for creating a key-value pair (KVP) Datatype
        using space-delimited pairs with equals-sign separators.
      value:
        id: firewall_kvp
        lib: custom
        dataFormat: kvp
        automaticExtraction:
          extractionType: kvp
          delimiter: " "
          equals: =
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeCreateExamplesXmlMinimal:
      summary: Create an XML Datatype
      description: Example request body for creating an XML Datatype with only the
        required extraction configuration.
      value:
        id: generic_xml_events
        lib: custom
        dataFormat: xml
        automaticExtraction:
          extractionType: xml
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeCreateExamplesXmlWindowsEvent:
      summary: Create an XML Datatype for Windows Event Log
      description: Example request body for creating an XML Datatype optimized for
        Windows Event Log data with attribute preservation.
      value:
        id: windows_event_xml
        lib: custom
        dataFormat: xml
        automaticExtraction:
          extractionType: xml
          keepAttr: true
          transformer: win_event
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeCreateExamplesWithDescription:
      summary: Create a delimited Datatype with metadata and field list
      description: Example request body for creating a custom delimited-text Datatype
        with metadata (description and tags) and an explicit field list for
        extraction.
      value:
        id: security_firewall_csv
        lib: custom
        description: Firewall syslog exported as delimited text
        tags: security,network
        dataFormat: delimited
        automaticExtraction:
          extractionType: delimited
          delimiter: ","
          quote: '"'
          fieldList:
            - _raw
            - src_ip
            - dest_ip
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeCreateExamplesParquetLake:
      summary: Create a Parquet Datatype
      description: Example request body for creating a Parquet Datatype for Cribl
        Lake-backed Datasets with raw payload preservation.
      value:
        id: lake_security_parquet
        lib: custom
        dataFormat: parquet
        shouldUseDataRaw: true
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeCreateExamplesNdjsonWithMaxEventBytes:
      summary: Create an NDJSON Datatype with a custom per-event byte limit
      description: Example request body for creating an NDJSON Datatype with a custom
        per-event byte limit for large JSON documents.
      value:
        id: large_payload_ndjson
        lib: custom
        dataFormat: ndjson
        maxEventBytes: 1048576
        automaticExtraction:
          extractionType: json
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeUpdateExamplesUpdateMetadata:
      summary: Update Datatype description and tags
      description: Example request body for updating the description and tags for an
        existing Datatype.<br/><br/>The request body must include a complete
        representation of the Datatype that you want to update. This endpoint
        does not support partial updates.
      value:
        id: app_ndjson_logs
        lib: custom
        description: Application JSON logs (curated)
        tags: app,prod
        dataFormat: ndjson
        automaticExtraction:
          extractionType: json
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeUpdateExamplesUpdateMaxEventBytes:
      summary: Update a Datatype to increase per-event byte limit
      description: Example request body for updating an NDJSON Datatype to increase
        the per-event byte limit.<br/><br/>The request body must include a
        complete representation of the Datatype that you want to update. This
        endpoint does not support partial updates.
      value:
        id: app_ndjson_logs
        lib: custom
        dataFormat: ndjson
        maxEventBytes: 131072
        automaticExtraction:
          extractionType: json
        timestampExtraction:
          type: auto
          scanDepth: 150
    DatatypeUpdateExamplesUpdateSchemaMapAndAddFields:
      summary: Update a Datatype to add field renaming and computed fields
      description: Example request body for updating a Datatype to add field renaming
        and computed fields.<br/><br/>The request body must include a complete
        representation of the Datatype that you want to update. This endpoint
        does not support partial updates.
      value:
        id: app_ndjson_logs
        lib: custom
        dataFormat: ndjson
        automaticExtraction:
          extractionType: json
        schemaMap:
          - fieldName: src_ip
            source: source_address
        addFields:
          - fieldName: env
            source: "'production'"
        timestampExtraction:
          type: auto
          scanDepth: 150
    AclApplyNotebookExamplesGrantAccess:
      summary: Grant a Notebook policy to Members
      description: Example request body for granting a Notebook policy to the
        specified Members.
      value:
        add:
          NotebookBase:
            - user1@example.com
            - user2@example.com
    AclApplyNotebookExamplesRevokeAccess:
      summary: Revoke a Notebook policy from Members
      description: Example request body for revoking a Notebook policy from the
        specified Members.
      value:
        rm:
          NotebookMaintain:
            - user3@example.com
    AclTeamsApplyNotebookExamplesGrantTeamAccess:
      summary: Grant a Notebook policy to Teams
      description: Example request body for granting a Notebook policy to the
        specified Teams.
      value:
        add:
          NotebookBase:
            - engineering-team
            - data-team
    AclTeamsApplyNotebookExamplesRevokeTeamAccess:
      summary: Revoke a Notebook policy from Teams
      description: Example request body for revoking a Notebook policy from the
        specified Teams.
      value:
        rm:
          NotebookMaintain:
            - former-team
    CreateNotebookExamplesSimpleNotebook:
      summary: Create a Notebook with one Chart section
      description: Example request body for creating a Notebook with one Chart
        visualization section.
      value:
        id: error_investigation
        info:
          name: Error Investigation
          created: 1714000000000
          createdBy: admin
          modified: 1714000000000
        sections:
          - id: section_0
            type: chart.column
            variant: chart
            title: Errors by source
            info:
              title: Errors by source
              created: 1714000000000
              createdBy: admin
              modified: 1714000000000
            search:
              type: inline
              query: error OR fail | chart count() by source
              earliest: -24h
              latest: now
    UpdateNotebookExamplesUpdateNotebook:
      summary: Update a Notebook
      description: Example request body for updating an existing
        Notebook.<br/><br/>The request body must include a complete
        representation of the Notebook that you want to update. This endpoint
        does not support partial updates.
      value:
        id: error_investigation
        info:
          name: Error Investigation - Updated
          created: 1714000000000
          createdBy: admin
          modified: 1714003600000
        sections:
          - id: section_0
            type: chart.column
            variant: chart
            title: Errors by source
            info:
              title: Errors by source
              created: 1714000000000
              createdBy: admin
              modified: 1714000000000
            search:
              type: inline
              query: error OR fail | chart count() by source
              earliest: -24h
              latest: now
          - id: section_1
            type: list.events
            variant: events
            title: Recent error events
            info:
              title: Recent error events
              created: 1714003600000
              createdBy: admin
              modified: 1714003600000
            search:
              type: inline
              query: error OR fail | head 100
              earliest: -1h
              latest: now
    LogNotebookActivityExamplesViewActivity:
      summary: Log a Notebook view event
      description: Example request body for logging that a user viewed a Notebook.
      value:
        _time: 1714000000
        displayName: Ada Lovelace
        email: ada@example.com
        notebookId: error_investigation
        type: view
        user: ada
    UsageGroupCreateExamplesWithRules:
      summary: Create a Usage Group with search limit rules
      description: Example request body for creating a Usage Group with search limit rules.
      value:
        id: power_users
        description: Members with elevated search limits.
        enabled: true
        rules:
          maxResultsPerSearch:
            type: maxResultsPerSearch
            limit: 100000
          maxConcurrentAdhocSearchesPerUser:
            type: maxConcurrentAdhocSearchesPerUser
            limit: 50%
    UsageGroupCreateExamplesWithExecutionCaps:
      summary: Create a Usage Group with runtime and data volume limits
      description: Example request body for creating a Usage Group with runtime and
        data volume limits.
      value:
        id: strict_team
        enabled: true
        rules:
          maxResultsPerSearch:
            type: maxResultsPerSearch
            limit: 25000
          maxRunningTimePerSearch:
            type: maxRunningTimePerSearch
            limit: 3600
          maxBytesReadPerSearch:
            type: maxBytesReadPerSearch
            limit: 1073741824
    UsageGroupUpdateExamplesUpdateDescription:
      summary: Update a Usage Group to remove rules
      description: Example request body for updating a Usage Group with an empty
        <code>rules</code> object.<br/><br/>The request body must include a
        complete representation of the Usage Group that you want to update. This
        endpoint does not support partial updates.
      value:
        id: power_users
        description: Members with elevated search limits.
        enabled: true
        rules: {}
    UsageGroupUpdateExamplesAdjustLimits:
      summary: Update limit rules for a Usage Group
      description: Example request body for updating a Usage Group with stricter
        <code>rules</code>.<br/><br/>The request body must include a complete
        representation of the Usage Group that you want to update. This endpoint
        does not support partial updates.
      value:
        id: power_users
        rules:
          maxResultsPerSearch:
            type: maxResultsPerSearch
            limit: 75000
          maxTimerangeWidth:
            type: maxTimerangeWidth
            limit: 604800
    UsageGroupUpdateExamplesDisableGroup:
      summary: Update a Usage Group to disable it and remove rules
      description: Example request body for updating a Usage Group to disable it and
        remove all rules.<br/><br/>The request body must include a complete
        representation of the Usage Group that you want to update. This endpoint
        does not support partial updates.
      value:
        id: power_users
        description: Members with elevated search limits.
        enabled: false
        rules: {}
    AclApplyDatasetProviderExamplesGrantAccess:
      summary: Grant a Dataset Provider policy to Members
      description: Example request body for granting a Dataset Provider policy to the
        specified Members.
      value:
        add:
          DatasetProviderRead:
            - user1@example.com
            - user2@example.com
    AclApplyDatasetProviderExamplesRevokeAccess:
      summary: Revoke a Dataset Provider policy from Members
      description: Example request body for revoking a Dataset Provider policy from
        the specified Members.
      value:
        rm:
          DatasetProviderMaintain:
            - user3@example.com
    AclTeamsApplyDatasetProviderExamplesGrantTeamAccess:
      summary: Grant a Dataset Provider policy to Teams
      description: Example request body for granting a Dataset Provider policy to the
        specified Teams.
      value:
        add:
          DatasetProviderRead:
            - engineering-team
            - data-team
    AclTeamsApplyDatasetProviderExamplesRevokeTeamAccess:
      summary: Revoke a Dataset Provider policy from Teams
      description: Example request body for revoking a Dataset Provider policy from
        the specified Teams.
      value:
        rm:
          DatasetProviderMaintain:
            - former-team
    DatasetProviderResponseExampleDefault:
      summary: Get an S3 Dataset Provider
      description: Example response for getting an S3 Dataset Provider.
      value:
        id: prod_s3_logs
        description: Production log archive in S3
        type: s3
        signatureVersion: v4
        awsAuthenticationMethod: manual
        awsApiKey: access_key
        awsSecretKey: "**************"
        assumeRoleArn: ""
        assumeRoleExternalId: ""
        reuseConnections: true
        rejectUnauthorized: true
        enableAssumeRole: true
        enableAbacTagging: false
        durationSeconds: 3600
    DatasetProviderCreateExamplesAzureBlobConnectionString:
      summary: Create an Azure Blob Dataset Provider with connection string
        authentication
      description: Example request body for creating an Azure Blob Dataset Provider
        using connection string authentication.
      value:
        id: my_azure_blob
        type: azure_blob
        authenticationMethod: connection_string
        networkingMethod: internet_routing
        location: eastus
        connectionString: "*****************"
    DatasetProviderCreateExamplesAzureBlobPrivateLink:
      summary: Create an Azure Blob Dataset Provider with Private Link routing
      description: Example request body for creating an Azure Blob Dataset Provider
        with Private Link networking and service-principal (client secret)
        authentication. Requires <code>privateLinkResourceId</code>,
        <code>privateLinkId</code>, and <code>location</code>.
      value:
        id: azure_blob_private_link
        type: azure_blob
        authenticationMethod: connection_string
        networkingMethod: private_link
        location: eastus
        connectionString: "*****************"
        privateLinkResourceId: /subscriptions/12345678-1234-1234-1234-123456789012/resourceGroups/rg-prod/providers/Microsoft.Storage/storageAccounts/mystorageacct
        privateLinkId: cribl-search-pl-connection
    DatasetProviderCreateExamplesApiHttpMinimalCustomCatalog:
      summary: Create an HTTP API Dataset Provider with a minimal REST catalog
      description: Example request body for creating an HTTP API Dataset Provider with
        no authentication or pagination. Defines a single endpoint in
        <code>availableEndpoints</code>.
      value:
        id: custom_rest_catalog
        type: api_http
        authenticationMethod: none
        paginationMethod: none
        availableEndpoints:
          - name: listEvents
            url: https://api.example.com/v1/events
            method: GET
    DatasetProviderCreateExamplesSnowflakeKeyPair:
      summary: Create a Snowflake Dataset Provider with key-pair authentication
      description: Example request body for creating a Snowflake Dataset Provider
        using key-pair authentication. Replace the private key value with your
        own private key.
      value:
        id: snowflake_search
        type: snowflake
        accountIdentifier: xy12345.us-east-1.aws
        username: SVC_SEARCH_USER
        privKey: "******************"
    DatasetProviderCreateExamplesS3AssumeRole:
      summary: Create an S3 Dataset Provider with AssumeRole authentication
      description: "Example request body for creating an S3 Dataset Provider using
        <code>awsAuthenticationMethod: auto</code> and an assume role ARN for
        authentication."
      value:
        id: my_s3_assume_role
        type: s3
        reuseConnections: true
        rejectUnauthorized: true
        enableAssumeRole: true
        enableAbacTagging: false
        durationSeconds: 3600
        signatureVersion: v4
        awsAuthenticationMethod: auto
        assumeRoleArn: arn:aws:iam::123456789012:role/SearchDataAccess
        assumeRoleExternalId: sample-external-id
        awsApiKey: ""
        awsSecretKey: ""
    DatasetProviderCreateExamplesS3WithDescription:
      summary: Create an S3 Dataset Provider with AWS API and secret key authentication
      description: "Example request body for creating an S3 Dataset Provider using
        <code>awsAuthenticationMethod: manual</code> and an AWS access key and
        secret key for authentication, with an optional description."
      value:
        id: prod_s3_logs
        description: Production log archive in S3
        type: s3
        signatureVersion: v4
        awsAuthenticationMethod: manual
        awsApiKey: access_key
        awsSecretKey: "*****************"
        reuseConnections: true
        rejectUnauthorized: true
        enableAssumeRole: true
        enableAbacTagging: false
        durationSeconds: 3600
        assumeRoleArn: ""
        assumeRoleExternalId: ""
    DatasetProviderCreateExamplesMinimalGcs:
      summary: Create a GCS Dataset Provider with service account credentials
      description: Example request body for creating a Google Cloud Storage Dataset
        Provider with inline service account JSON passed as a string for
        authentication.
      value:
        id: gcs_security_bucket
        type: gcs
        serviceAccountCredentials: "*****************"
    DatasetProviderCreateExamplesAmazonSecurityLakeAssumeRole:
      summary: Create an Amazon Security Lake Dataset Provider with assume role
        authentication
      description: Example request body for creating an Amazon Security Lake Dataset
        Provider using assume role authentication. Uses the same configuration
        fields as S3 providers, with <code>type</code> set to
        <code>amazon_security_lake</code>.
      value:
        id: security_lake_orgs
        type: amazon_security_lake
        awsAuthenticationMethod: auto
        reuseConnections: true
        rejectUnauthorized: true
        enableAssumeRole: true
        enableAbacTagging: false
        durationSeconds: 3600
        assumeRoleArn: arn:aws:iam::123456789012:role/SecurityLakeSearchRead
    DatasetProviderCreateExamplesApiAzureServicePrincipal:
      summary: Create an Azure API Dataset Provider with service principal
        authentication
      description: Example request body for creating an Azure API Dataset Provider
        using Azure AD service principal credentials. Each entry in
        <code>accountConfigs</code> represents a named Azure AD application with
        its client ID, client secret, and tenant ID.
      value:
        id: azure_api_inventory
        type: api_azure
        accountConfigs:
          - name: primary
            clientId: 00000000-0000-0000-0000-000000000000
            clientSecret: "***************"
            tenantId: 00000000-0000-0000-0000-000000000000
    DatasetProviderCreateExamplesApiHttpOAuthClientCredentials:
      summary: Create an HTTP API Dataset Provider with OAuth client credentials
        authentication
      description: Example request body for creating an HTTP API Dataset Provider
        using OAuth client credentials for token acquisition. Adjust
        <code>loginUrl</code>, <code>clientSecretValue</code>, and
        <code>extraAuthenticationParameters</code> for your identity provider.
      value:
        id: custom_api_oauth
        type: api_http
        authenticationMethod: oauth
        paginationMethod: none
        loginUrl: https://login.example.com/oauth2/v1/token
        clientSecretParameter: client_secret
        clientSecretValue: YOUR_CLIENT_SECRET
        tokenAttribute: access_token
        authorizationHeader: Authorization
        authorizeExpression: Bearer ${token}
        availableEndpoints:
          - name: search
            url: https://api.example.com/v1/query
            method: POST
            headers: []
    DatasetProviderCreateExamplesApiLogAnalyticsServicePrincipal:
      summary: Create an Azure Log Analytics Dataset Provider with service principal
        authentication
      description: Example request body for creating an Azure Log Analytics Dataset
        Provider using Microsoft Entra ID client credentials.
      value:
        id: la_repsol_prod
        type: api_log_analytics
        tenantId: 00000000-0000-0000-0000-000000000000
        clientId: 00000000-0000-0000-0000-000000000000
        clientSecret: "***************"
        workspaceId: 550e8400-e29b-41d4-a716-446655440000
    DatasetProviderUpdateExamplesSwitchToManualKeys:
      summary: Update an S3 Dataset Provider to change the authentication method
      description: Example request body for updating an existing S3 Dataset Provider
        to use manual AWS access key authentication instead of assume
        role.<br/><br/>The request body must include a complete representation
        of the Dataset Provider that you want to update. This endpoint does not
        support partial updates.
      value:
        id: prod_s3_logs
        description: Production log archive in S3
        type: s3
        signatureVersion: v4
        awsAuthenticationMethod: manual
        awsApiKey: access_key
        awsSecretKey: "**************"
        assumeRoleArn: ""
        assumeRoleExternalId: ""
        reuseConnections: true
        rejectUnauthorized: true
        enableAssumeRole: true
        enableAbacTagging: false
        durationSeconds: 3600
    AclApplyDatasetExamplesGrantAccess:
      summary: Grant a Dataset policy to Members
      description: Example request body for granting a Dataset policy to the specified
        Members.
      value:
        add:
          DatasetRead:
            - user1@example.com
            - user2@example.com
    AclApplyDatasetExamplesRevokeAccess:
      summary: Revoke a Dataset policy from Members
      description: Example request body for revoking a Dataset policy from the
        specified Members.
      value:
        rm:
          DatasetMaintain:
            - user3@example.com
    AclTeamsApplyDatasetExamplesGrantTeamAccess:
      summary: Grant a Dataset policy to Teams
      description: Example request body for granting a Dataset policy to the specified
        Teams.
      value:
        add:
          DatasetRead:
            - engineering-team
            - data-team
    AclTeamsApplyDatasetExamplesRevokeTeamAccess:
      summary: Revoke a Dataset policy from Teams
      description: Example request body for revoking a Dataset policy from the
        specified Teams.
      value:
        rm:
          DatasetMaintain:
            - former-team
    DatasetResponseExampleCreatedS3Dataset:
      summary: S3 V1 Dataset
      description: Example S3 V1 Dataset.
      value:
        id: prod_access_logs
        provider: my_s3_provider
        type: s3
        bucket: company-access-logs
    DatasetCreateExamplesS3V2WithPaths:
      summary: Create an S3 Dataset with search execution v2 and multi-bucket paths
      description: Example request body for creating an S3 Dataset using search
        execution v2. The v2 schema uses a <code>paths</code> array instead of a
        top-level <code>bucket</code> field. Each path entry specifies a bucket
        and one or more glob-to-datatype filter mappings.
      value:
        id: prod_access_logs_v2
        provider: my_s3_provider
        type: s3
        searchVersion: v2
        skipEventTimeFilter: false
        storageClasses:
          - STANDARD
        paths:
          - bucket: logs
            region: us-east-1
            autoDetectRegion: false
            partitioningScheme: none
            filters:
              - filter: "**"
                dataTypeId: custom_json
              - filter: "**"
                dataTypeId: generic_ndjson
    DatasetCreateExamplesMinimalS3:
      summary: Create an S3 Dataset (v1) with only required fields
      description: "Example request body for creating a Cribl Search Dataset that uses
        an existing S3 Dataset Provider using only required fields. The
        <code>type</code> value must match the Dataset Provider. This is the v1
        shape; for ClickHouse/multi-path setups use <code>searchVersion:
        v2</code> with <code>paths</code> instead."
      value:
        id: prod_access_logs
        provider: my_s3_provider
        type: s3
        bucket: company-access-logs
        region: us-east-1
        searchVersion: v1
    DatasetCreateExamplesWithDescriptionAndTags:
      summary: Create an S3 Dataset with optional fields
      description: Example request body for creating an S3 Dataset with optional
        fields including description, tags, a templated bucket path, a filter
        expression, and breaker rulesets.
      value:
        id: security_vpc_flow
        description: VPC flow logs for the security account
        tags: security,network
        provider: shared_s3_security
        region: us-east-1
        type: s3
        bucket: vpc-flow-${account_id}
        filter: source.endsWith('.log')
        breakerRulesets:
          - sample_rule
    DatasetCreateExamplesAzureBlobV1ContainerName:
      summary: Create an Azure Blob Dataset with a container path
      description: Example request body for creating an Azure Blob Dataset. Azure Blob
        Datasets use <code>containerName</code> instead of <code>bucket</code>
        for the container path.
      value:
        id: azure_prod_logs
        provider: my_azure_blob
        type: azure_blob
        containerName: prod-logs
    DatasetCreateExamplesAzureBlobV2WithPaths:
      summary: Create an Azure Blob Dataset with search execution v2 and
        multi-container paths
      description: Example request body for creating an Azure Blob Dataset using
        search execution v2. The v2 schema uses a <code>paths</code> array where
        each entry specifies a container and one or more glob-to-datatype filter
        mappings.
      value:
        id: azure_security_logs_v2
        provider: azure_blob_private_link
        type: azure_blob
        searchVersion: v2
        paths:
          - bucket: security-logs
            filters:
              - filter: "**"
                dataTypeId: generic_ndjson
    DatasetCreateExamplesMinimalGcs:
      summary: Create a Google Cloud Storage Dataset with only required fields
      description: Example request body for creating a Google Cloud Storage (GCS)
        Dataset with only the required fields.
      value:
        id: gcs_security_bucket
        provider: my_gcs_provider
        type: gcs
        bucket: gcs-security-events
        region: US-CENTRAL1
    DatasetCreateExamplesAmazonSecurityLake:
      summary: Create an Amazon Security Lake Dataset
      description: Example request body for creating an Amazon Security Lake Dataset.
        Uses <code>selectedBuckets</code> to specify one or more Security Lake
        buckets, with an optional <code>region</code> per bucket.
      value:
        id: security_lake_prod
        provider: security_lake_orgs
        type: amazon_security_lake
        selectedBuckets:
          - name: aws-security-data-lake-us-west-2-abc123
            region: us-west-2
    DatasetCreateExamplesSnowflakeTable:
      summary: Create a Snowflake Dataset
      description: Example request body for creating a Snowflake Dataset. The
        <code>table</code> field specifies the Snowflake table, view, or SQL
        query to search.
      value:
        id: snowflake_access_events
        provider: snowflake_search
        type: snowflake
        database: PROD
        schema: LOGS
        table: ACCESS_EVENTS
        timestampField: EVENT_TIME
    DatasetCreateExamplesHttpApiEnabledEndpoints:
      summary: Create an HTTP API-backed Dataset
      description: Example request body for creating a Cribl Search Dataset that uses
        an existing HTTP API Dataset Provider. The <code>enabledEndpoints</code>
        array lists the Dataset Provider endpoint identifiers to activate.
      value:
        id: ticketing_api
        provider: http_provider_ticketing
        type: api_http
        enabledEndpoints:
          - search_tickets
          - ticket_detail
    DatasetCreateExamplesApiAzureResourceManager:
      summary: Create an Azure API Dataset for Azure Resource Manager resources
      description: Example request body for creating an Azure API Dataset that queries
        Azure Resource Manager resources. The <code>enabledEndpoints</code>
        array specifies which resource types to query, and
        <code>subscriptionIds</code> scopes the query to specific Azure
        subscriptions.
      value:
        id: azure_vm_inventory
        provider: azure_api_inventory
        type: api_azure
        enabledEndpoints:
          - virtualMachines
          - disks
        subscriptionIds:
          - 12345678-1234-1234-1234-123456789012
    DatasetCreateExamplesApiLogAnalyticsSecurityEvent:
      summary: Create an Azure Log Analytics Dataset scoped to a table
      description: Example request body for creating an Azure Log Analytics Dataset
        that queries the SecurityEvent table in a workspace.
      value:
        id: la_repsol_security_events
        provider: la_repsol_prod
        type: api_log_analytics
        table: SecurityEvent
        timestampField: TimeGenerated
        timestampFieldContents: kusto_datetime
    DatasetCreateExamplesApiLogAnalyticsConstrainedKql:
      summary: Create an Azure Log Analytics Dataset with constrained KQL
      description: Example request body for creating an Azure Log Analytics Dataset
        that pre-filters sign-in events to failed authentication attempts.
      value:
        id: la_repsol_auth_failures
        provider: la_repsol_prod
        type: api_log_analytics
        table: SigninLogs | where ResultType != 0
        timestampField: TimeGenerated
        timestampFieldContents: kusto_datetime
    DatasetUpdateExampleUpdateDescription:
      summary: Update Dataset description and extra paths
      description: Example request body for updating a Cribl Search Dataset
        description and extra paths.<br/><br/>The request body must include a
        complete representation of the Dataset that you want to update. This
        endpoint does not support partial updates.
      value:
        id: prod_access_logs
        provider: my_s3_provider
        type: s3
        bucket: company-access-logs
        description: Production ALB access logs (curated)
        extraPaths:
          - filter: true
            autoDetectRegion: false
            partitioningScheme: none
            bucket: store-access-logs
            region: us-west-1
    FederatedSearchEngineUpdateExamplesTierOnly:
      summary: Update billing/compute tier to a named engine size
      description: Example request body for updating the billing/compute tier for a
        federated search engine to the named size
        <code>medium</code>.<br/><br/>The request body must include a complete
        representation of the federated search engine that you want to update.
        This endpoint does not support partial updates.
      value:
        id: Federated
        engineType: federated
        tierSize: medium
    FederatedSearchEngineUpdateExamplesUsageBased:
      summary: Update billing/compute tier to usage-based billing
      description: Example request body for updating the billing/compute tier for a
        federated search engine to usage-based billing.<br/><br/>The request
        body must include a complete representation of the federated search
        engine that you want to update. This endpoint does not support partial
        updates.
      value:
        id: Federated
        engineType: federated
        tierSize: usage_based
    FederatedSearchEngineUpdateExamplesWithDescription:
      summary: Update billing/compute tier size and add description
      description: Example request body for updating the billing/compute tier and
        adding a description for a federated search engine.<br/><br/>The request
        body must include a complete representation of the federated search
        engine that you want to update. This endpoint does not support partial
        updates.
      value:
        id: Federated
        engineType: federated
        tierSize: large
        description: Production federated search engine configuration
    LocalSearchEngineCountedResponseExamplesSingleEngine:
      summary: Single lakehouse engine object
      description: Example response body that shows a list containing a single
        lakehouse engine object.
      value:
        count: 1
        items:
          - id: local_ingest_primary
            engineType: local
            tierSize: small
            description: Primary ingestion engine for the default local Dataset.
            status: ready
            effectiveStatus: ready
            lastProvisionedMs: 1700000000000
            datasets:
              - main
            hasMain: true
            isStorageDeprovisioned: false
            isComputeDeprovisioned: false
            metricsLastPublishedAt: 1700000001000
    LocalSearchEngineCreateExamplesMinimal:
      summary: Create engine with only required parameters
      description: Example request body for creating and provisioning a lakehouse
        engine with only the required parameters and no optional metadata.
      value:
        id: local_ingest_min
        engineType: local
        tierSize: xsmall
    LocalSearchEngineCreateExamplesMediumWithDescription:
      summary: Create engine with medium tier size
      description: Example request body for creating and provisioning a lakehouse
        engine using the <code>medium</code> tier size for storage and compute,
        including a description.
      value:
        id: local_ingest_analytics
        engineType: local
        tierSize: medium
        description: Dedicated engine for analytics workloads
    LocalSearchEngineUpdateExamplesResize:
      summary: Resize the engine to a large tier.
      description: Example request body for increasing capacity while keeping
        operator-only tiers on the mansion route.
      value:
        id: local_ingest_primary
        engineType: local
        tierSize: large
    LocalSearchEngineUpdateExamplesUpdateDescription:
      summary: Update engine description without changing tier size
      description: Example request body for updating only the description for an
        existing lakehouse engine.<br/><br/>The request body must include a
        complete representation of the lakehouse engine that you want to update.
        This endpoint does not support partial updates.
      value:
        id: local_ingest_primary
        engineType: local
        tierSize: small
        description: Engine after workload consolidation.
    LocalSearchDatasetRulesetCountedResponseExamplesSingleRuleset:
      summary: Single Dataset ruleset object
      description: Example response body that shows a list containing a single Dataset
        ruleset object.
      value:
        count: 1
        items:
          - id: default
            rules:
              - id: default
                name: main
                description: data catch all
                kustoExpression: "*"
                sendDataTo: destinationDataset
                dataset: main
    LocalSearchDatasetRulesetCreateExamplesDefaultShape:
      summary: Create the default catch-all dataset ruleset.
      description: Example request body for a ruleset that routes all events to the
        main dataset using a wildcard Kusto filter.
      value:
        id: default
        rules:
          - id: default
            name: main
            description: data catch all
            kustoExpression: "*"
            sendDataTo: destinationDataset
            dataset: main
    LocalSearchDatasetRulesetCreateExamplesMinimal:
      summary: Create a dataset ruleset with one minimal rule.
      description: Example request body for creating a dataset ruleset with required
        rule fields and a simple Kusto filter.
      value:
        id: custom_ruleset
        rules:
          - id: rule_1
            name: security logs
            kustoExpression: vendor == "cribl"
            dataset: main
    LocalSearchDatasetRulesetCreateExamplesWithExtendExpression:
      summary: Create a ruleset whose rule transforms fields with a KQL extend.
      description: Example request body for creating a dataset ruleset where a rule
        applies an extend expression to matched events.
      value:
        id: custom_ruleset
        rules:
          - id: enrich_vendor
            name: normalize vendor
            kustoExpression: isnotempty(vendor)
            dataset: main
            extendExpression: vendor = toupper(vendor)
            extendExpressionEnabled: true
    LocalSearchDatasetRulesetUpdateExamplesAddRule:
      summary: Append a second routing rule to an existing ruleset.
      description: Example request body for updating a dataset ruleset so a narrower
        rule routes matching events to another dataset.
      value:
        id: default
        rules:
          - id: secondary
            name: secondary route
            kustoExpression: sourcetype == "test"
            dataset: secondary_ds
          - id: default
            name: main
            description: data catch all
            kustoExpression: "*"
            sendDataTo: destinationDataset
            dataset: main
    LocalSearchDatasetRulesetUpdateExamplesMinimal:
      summary: Replace the ruleset with a single minimal routing rule.
      description: Example request body for updating a dataset ruleset to a minimal
        rule list with only required rule fields.
      value:
        id: default
        rules:
          - id: rule_1
            name: security logs
            kustoExpression: vendor == "cribl"
            dataset: main
    LocalSearchDatasetRulesetUpdateExamplesWithExtendExpression:
      summary: Update rules to apply a KQL extend expression on match.
      description: Example request body for updating a dataset ruleset so a rule
        enriches events using a KQL extend expression.
      value:
        id: default
        rules:
          - id: enrich
            name: enrich vendor
            kustoExpression: isnotempty(vendor)
            dataset: main
            extendExpression: vendor = toupper(vendor)
            extendExpressionEnabled: true
    LocalSearchDatatypeRulesetCountedResponseExamplesSingleRuleset:
      summary: Single Datatype ruleset object
      description: Example response body that shows a list containing a single
        Datatype ruleset object.
      value:
        count: 1
        items:
          - id: default
            rules:
              - id: rule_for_palo_alto_traffic
                name: Filter for Palo Alto Traffic Syslogs
                description: For finding and parsing Palo Alto Traffic Syslogs
                kustoExpression: __inputId="cribl_http:pan_traffic_syslog"
                datatype: pan_traffic_syslog
    LocalSearchDatatypeRulesetCreateExamplesDefaultShape:
      summary: Create the default catch-all datatype ruleset.
      description: Example request body for creating a datatype ruleset that assigns
        all events to a primary datatype using a wildcard Kusto filter.
      value:
        id: default
        rules:
          - id: default
            name: catch all
            description: datatype catch all
            kustoExpression: "*"
            datatype: generic_ndjson
    LocalSearchDatatypeRulesetCreateExamplesMinimal:
      summary: Create a datatype ruleset with one minimal rule.
      description: Example request body for creating a datatype ruleset with required
        rule fields and a simple Kusto filter.
      value:
        id: custom_ruleset
        rules:
          - id: rule_1
            name: json events
            kustoExpression: vendor == "cribl"
            datatype: generic_ndjson
    LocalSearchDatatypeRulesetCreateExamplesEmptyRules:
      summary: Create a ruleset with no rules yet.
      description: Example request body for creating an empty datatype ruleset
        reserved for later rule configuration.
      value:
        id: draft
        rules: []
    LocalSearchDatatypeRulesetUpdateExamplesAddRule:
      summary: Append a second datatype rule to an existing ruleset.
      description: Example request body for updating a datatype ruleset so a narrower
        rule assigns matching events to another datatype.
      value:
        id: default
        rules:
          - id: secondary
            name: secondary datatype
            kustoExpression: sourcetype == "test"
            datatype: secondary_dt
          - id: default
            name: catch all
            description: datatype catch all
            kustoExpression: "*"
            datatype: generic_ndjson
    LocalSearchDatatypeRulesetUpdateExamplesMinimal:
      summary: Replace the ruleset with a single minimal datatype rule.
      description: Example request body for updating a datatype ruleset to a minimal
        rule list with only required rule fields.
      value:
        id: default
        rules:
          - id: rule_1
            name: security logs
            kustoExpression: vendor == "cribl"
            datatype: generic_ndjson
    LocalSearchDatatypeRulesetUpdateExamplesWithDisabledRule:
      summary: Update rules so one mapping is disabled.
      description: Example request body for updating a datatype ruleset where a rule
        remains defined but is excluded from matching.
      value:
        id: default
        rules:
          - id: inactive
            name: unused mapping
            kustoExpression: "false"
            datatype: archive
            disabled: true
    ApiCredentialUpdateExamplesBasicUpdate:
      summary: Assign a single Role to an API Credential
      description: Example request body for assigning the <code>admin</code> Role to
        an API Credential.<br/><br/>The request body must include a complete
        representation of the API Credential that you want to update. This
        endpoint does not support partial updates.
      value:
        roles:
          - admin
    ApiCredentialUpdateExamplesMultipleRoles:
      summary: Assign multiple Roles to an API Credential
      description: Example request body for assigning multiple Roles to an API
        Credential.<br/><br/>The request body must include a complete
        representation of the API Credential that you want to update. This
        endpoint does not support partial updates.
      value:
        roles:
          - admin
          - stream_user
    AppAclTeamsApplyExamplesGrantTeamAccess:
      summary: Grant AppUser policy to Teams
      description: Example request body for granting the <code>AppUser</code> policy
        to the specified Teams.
      value:
        add:
          AppUser:
            - engineering-team
            - data-team
    AppAclTeamsApplyExamplesRevokeTeamAccess:
      summary: Revoke AppUser policy from Teams
      description: Example request body for revoking the <code>AppUser</code> policy
        from the specified Teams.
      value:
        rm:
          AppUser:
            - former-team
    AppAclApplyExamplesGrantAccess:
      summary: Grant AppUser policy to Members
      description: Example request body for granting the <code>AppUser</code> policy
        to the specified Members.
      value:
        add:
          AppUser:
            - user1
            - user2
    AppAclApplyExamplesRevokeAccess:
      summary: Revoke AppUser policy from Members
      description: Example request body for revoking the <code>AppUser</code> policy
        from the specified Members.
      value:
        rm:
          AppUser:
            - user3
    AppInstallExamplesHostedCrblUrl:
      summary: Install App from a hosted URL
      description: Example request body for installing an App by providing the direct
        URL location of a hosted <code>.crbl</code> file as the
        <code>source</code> value.
      value:
        source: https://cdn.cribl.io/dl/apps/cribl-example-app/latest/cribl-example-app-latest.crbl
        force: true
    AppInstallExamplesEmptyAppSkeleton:
      summary: Create new empty App
      description: Example request body for creating a new empty App.
      value:
        id: testAppFoo
        version: 0.0.1
        displayName: testAppFoo
    AppInstallExamplesUploadedFile:
      summary: Install App from file upload
      description: Example request body for installing an App by specifying the
        filename of an uploaded file as the <code>source</code> value.
      value:
        source: cribl-search-missing-logs-1.0.1.Do7DH5I.tgz
        id: cribl-search-missing-logs
    AppInstallExamplesURL:
      summary: Install App from a URL
      description: Example request body for installing an App by providing the direct
        URL location of a <code>.crbl</code> file as the <code>source</code>
        value.
      value:
        source: https://cdn.cribl.io/dl/apps/cribl-example-app/1.0.0/cribl-example-app-1.0.0.tgz
    AppInstallExamplesGitRepository:
      summary: Install App from Git repository
      description: Example request body for installing an App by importing from a Git
        repository. Specify <code>git+<repo-url></code> as the
        <code>source</code> value.
      value:
        source: git+https://github.com/criblio/cribl_ocsf_postprocessing
    AppListPoliciesExamplesLookupPolicy:
      summary: Declared policy entry
      description: Example policy entry declared in <code>policies.yml</code> — grants
        <code>GET</code> access to the lookups API.
      value:
        object: /system/lookups
        actions:
          - GET
    AppPreinstallCheckExamplesStagedUpload:
      summary: Preinstall check for a staged upload
      description: "Example request body after <code>PUT /apps</code>: use the
        returned <code>source</code> filename. Works for both first-time
        installs and upgrades of an already-installed App."
      value:
        source: cribl-search-missing-logs-1.0.1.Do7DH5I.tgz
    AppPreinstallCheckExamplesHostedUrl:
      summary: Preinstall check from hosted artifact URL
      description: Example using a direct URL to a <code>.crbl</code> or
        <code>.tgz</code> artifact.
      value:
        source: https://cdn.cribl.io/dl/apps/cribl-example-app/1.0.0/cribl-example-app-1.0.0.tgz
    AppPreinstallCheckExamplesGitRepository:
      summary: Preinstall check from Git repository
      description: Example using a <code>git+</code> URL with an optional
        <code>spec</code> to pin a branch, tag, or commit. Pass the same
        <code>spec</code> you intend to use in the install or upgrade call so
        the correct revision is checked out. The server leaves the clone on disk
        so a subsequent <code>POST /apps</code> can reuse it via
        <code>fetch+checkout</code> instead of a full re-clone.
      value:
        source: git+https://github.com/criblio/cribl_ocsf_postprocessing
        spec: v1.2.0
    AppUpgradeExamplesUpgradeFromURL:
      summary: Upgrade App from a URL
      description: Example request body for upgrading an App by providing the direct
        URL location of a <code>.crbl</code> file as the <code>source</code>
        value.
      value:
        source: https://cdn.cribl.io/dl/apps/cribl-example-app/1.1.4/cribl-example-app-1.1.4.crbl
    AppUpgradeExamplesUpgradeFromUpload:
      summary: Upgrade App from file upload
      description: Example request body for upgrading an App by specifying the
        filename of an uploaded file as the <code>source</code> value.
      value:
        source: cribl-search-missing-logs-1.0.2.Do7DH5I.tgz
    CaptureExamplesSimpleExpression:
      summary: Capture events by sourcetype
      value:
        filter: sourcetype==="pan:traffic"
        maxEvents: 100
        duration: 5
        level: 0
    CaptureExamplesCompoundAndExpression:
      summary: Capture events using the AND operator to specify multiple conditions
      value:
        filter: sourcetype==="pan:traffic" && src_zone==="trusted"
        maxEvents: 100
        duration: 5
        level: 0
    CaptureExamplesNestedFieldAccess:
      summary: Capture events using dot notation to specify nested fields
      value:
        filter: sourcetype==="pan:traffic" && dest_geoip.country.iso_code === "US"
        maxEvents: 100
        duration: 5
        level: 0
    CaptureExamplesComplexFilter:
      summary: Capture with a complex filter that uses JavaScript methods
      value:
        filter: __inputId.startsWith("http:") && status >= 400 && status < 500
        maxEvents: 500
        duration: 15
        level: 1
    ClickHouseDescribeTableExamplesBasicAuth:
      summary: ClickHouse table with basic authentication
      value:
        url: http://localhost:8123/
        database: default
        tableName: events
        authType: basic
        username: default
        password: your-password
    ClickHouseDescribeTableExamplesNoAuth:
      summary: ClickHouse table without authentication
      value:
        url: http://localhost:8123/
        database: default
        tableName: events
    RotateTokenBatchExamplesRotateTokenByGuids:
      summary: Rotate provisioning token on multiple nodes by ID
      description: Example request body for rotating the provisioning token on the
        specified nodes by their <code>id</code> values.
      value:
        provisioningTokenId: stream-onprem-0
        guids:
          - guid-12345678-abcd-1234-abcd-123456789abc
          - guid-87654321-dcba-4321-dcba-cba987654321
    RotateTokenBatchExamplesRotateTokenByGroup:
      summary: Rotate token for multiple nodes by group
      description: Example request body for rotating the provisioning token on all
        Worker or Edge Nodes in the specified group.
      value:
        provisioningTokenId: stream-onprem-0
        filter:
          group: default
    RestartWorkersExamplesRestartWorkers:
      summary: Restart worker/edge Nodes
      description: Restart multiple Worker/Edge Nodes by providing an array of GUIDs
      value:
        guids:
          - guid-12345678-abcd-1234-abcd-123456789abc
          - guid-87654321-dcba-4321-dcba-cba987654321
          - guid-11111111-2222-3333-4444-555555555555
    RotateTokenExamplesRotateToken:
      summary: Rotate provisioning token on a single node
      description: Example request body for rotating the provisioning token on the
        specified node.
      value:
        provisioningTokenId: stream-onprem-0
    DistributedUpgradeExamplesRollingUpgrade:
      summary: Start a rolling upgrade
      description: Example request body for starting a rolling upgrade of 50% of
        Worker Nodes in a distributed deployment, with the default retry
        settings.
      value:
        upgradePercentage: 0.5
        upgradeMode: rolling
        workerRetries: 5
        workerRetryDelay: 1000
    HealthExamplesHealthyPrimary:
      summary: Healthy (primary)
      description: Example response for a healthy server that is acting as primary.
      value:
        status: healthy
        startTime: 1700000000000
        role: primary
        overlay:
          state: inactive
    Health420ExamplesShuttingDown:
      summary: Shutting down (primary)
      description: Example response for a server that is acting as primary and is in
        the process of shutting down.
      value:
        status: shutting down
        startTime: 1700000000000
        role: primary
        overlay:
          state: inactive
    Health420ExamplesStandby:
      summary: Standby
      description: Example response for a server that is in standby mode.
      value:
        status: standby
        startTime: 1700000000000
        role: standby
        overlay:
          state: inactive
    CreateLicenseExamplesAddLicense:
      summary: Add a license
      description: Example request body for adding a license to a Cribl deployment
        using a JSON Web Token (JWT) license string.
      value:
        license: eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJDcmlibCIsImV4cCI6MTcwMDAwMDAwMH0.example
    PackInstallExamplesPackDispensary:
      summary: Install from the Pack Dispensary
      value:
        source: https://packs.cribl.io/dl/cribl-duo-rest-io/latest/cribl-duo-rest-io-latest.crbl
        force: true
        allowCustomFunctions: true
    PackInstallExamplesEmptyPack:
      summary: Create new empty Pack
      value:
        version: 0.0.1
        tags:
          streamtags: []
        exports: []
        displayName: testPackFoo
        id: testPackFoo
    PackInstallExamplesUploadedFile:
      summary: Install Pack from file upload
      value:
        source: cribl-search-missing-logs-1.0.1.Do7DH5I.crbl
        id: cribl-search-missing-logs
        allowCustomFunctions: false
    PackInstallExamplesURL:
      summary: Install Pack from URL
      value:
        source: https://github.com/criblpacks/cribl-palo-alto-networks/releases/download/1.1.4/cribl-palo-alto-networks-a3e5a19d-1.1.4.crbl
        allowCustomFunctions: false
    PackInstallExamplesGitRepository:
      summary: Install Pack from Git repository
      value:
        source: git+https://github.com/criblio/cribl_ocsf_postprocessing
        allowCustomFunctions: false
    PackUpgradeExamplesUpgradeFromURL:
      summary: Upgrade Pack from URL
      value:
        source: https://github.com/criblpacks/cribl-palo-alto-networks/releases/download/1.1.4/cribl-palo-alto-networks-a3e5a19d-1.1.4.crbl
    PackCloneExamplesCloneToSingleGroup:
      summary: Clone Pack to one Worker Group
      description: Example request body for cloning a Pack from a source Worker Group
        to a single target Worker Group.
      value:
        srcGroup: default
        dstGroups:
          - group-2
        packs:
          - cribl-palo-alto-networks
        force: false
    PackCloneExamplesCloneToMultipleGroups:
      summary: Clone Pack to multiple Worker Groups
      description: "Example request body for cloning Packs from a source Worker Group
        to multiple target Worker Groups. Setting <code>force: true</code>
        overwrites any existing Packs with the same ID on the target Groups."
      value:
        srcGroup: default
        dstGroups:
          - group-2
          - group-3
        packs:
          - cribl-palo-alto-networks
          - cribl-aws
        force: true
    PreviewExamplesPipeModeWithEvents:
      summary: Preview with inline events (pipe mode)
      description: Example request body for sending sample events through a Pipeline
        using inline event data. Useful for testing Pipeline logic with custom
        event data.
      value:
        mode: pipe
        pipelineId: main
        sampleId: ""
        events:
          - _raw: 192.168.1.1 - - [01/Jan/2024:00:00:00] "GET /api" 200 1024
    PreviewExamplesPipeModeWithSample:
      summary: Preview with sample data (pipe mode)
      description: Example request body for sending events from a saved sample through
        the specified Pipeline.
      value:
        mode: pipe
        pipelineId: main
        sampleId: syslog-sample
    PreviewExamplesRouteMode:
      summary: Preview via Source (route mode)
      description: "Example request body for emulating events flowing through a Source
        and capturing output at the specified stage. The <code>level: 2</code>
        setting means that events will be captured after routing and immediately
        before the post-processing Pipeline."
      value:
        mode: route
        pipelineId: main
        sampleId: syslog-sample
        inputId: http-in
        level: 2
    SendDiagBundleExamplesSendToSupport:
      summary: Send a diagnostic bundle to Cribl Support
      description: Example request body for generating and sending a diagnostic bundle
        to Cribl Support, including the associated support case number.
      value:
        sendToCribl: true
        caseNumber: CS-12345
    SystemMetricsEnumExamplesfullFidelity:
      summary: Enumerate dimensions in a non-default namespace
      description: Example request body for enumerating metric dimensions from a
        non-default namespace with a limit on distinct values per dimension.
      value:
        namespace: full-fidelity
        maxValues: 50
    SystemMetricsQueryResponseExamplescumulativeBySource:
      summary: Cumulative aggregation by Source
      description: Example response body for a cumulative metrics query split by Source.
      value:
        results:
          - _raw: ""
            _time: 1714992000
            input: syslog:in_syslog:udp
            starttime: 1714988400
            endtime: 1714992000
            health: 1
    SystemMetricsQueryExamplescumulativeByInput:
      summary: Query cumulative aggregates by Source
      description: Example request body for querying cumulative metric aggregations
        filtered by Source and split by the Source dimension.
      value:
        where: input == 'syslog:in_syslog:udp'
        aggs:
          aggregations:
            - min(_time).as(starttime)
            - max(_time).as(endtime)
            - max("health.inputs").as("health")
          cumulative: true
          splitBys:
            - input
    SystemMetricsQueryExamplesnamespaceWithSplits:
      summary: Query a non-default namespace with dimension splits
      description: Example request body for querying cumulative aggregations from a
        non-default metrics namespace, split by a dimension.
      value:
        aggs:
          aggregations:
            - min("ff").as("ff")
          cumulative: true
          splitBys:
            - __dist_mode
        namespace: full-fidelity
    UpdateAuthExamplesLocalAuth:
      summary: Configure local authentication
      description: Example request body for configuring local
        authentication.<br/><br/>The request body must include a complete
        representation of the authentication settings that you want to update.
        This endpoint does not support partial updates.
      value:
        type: local
        host: localhost
        port: 9000
        ssl: false
        fallback: false
        fallbackBadLogin: false
    UpdateAuthExamplesLdapAuth:
      summary: Configure LDAP authentication
      description: Example request body for configuring LDAP authentication with
        fallback to local authentication.<br/><br/>The request body must include
        a complete representation of the authentication settings that you want
        to update. This endpoint does not support partial updates.
      value:
        type: ldap
        host: ldap.example.com
        port: 636
        ssl: true
        fallback: true
        fallbackBadLogin: true
        dn: uid={username},ou=users,dc=example,dc=com
        searchBase: ou=users,dc=example,dc=com
    UpdateSystemSettingsExamplesUpdateApiSettings:
      summary: Update API server settings
      description: Example request body for updating the Cribl API server network and
        TLS settings.
      value:
        api:
          host: 0.0.0.0
          port: 9000
          disabled: false
          ssl:
            disabled: false
            privKeyPath: /opt/cribl/local/cribl/auth/cribl.key
            certPath: /opt/cribl/local/cribl/auth/cribl.crt
            passphrase: ""
        system:
          upgrade: api
          intercom: true
        shutdown:
          drainTimeout: 10000
        sni:
          disableSNIRouting: false
        pii:
          enablePiiDetection: false
        workers:
          count: 0
          minimum: 1
          memory: 0
        proxy:
          useEnvVars: false
        tls:
          minVersion: TLSv1.2
          maxVersion: TLSv1.3
          defaultCipherList: DEFAULT
          defaultEcdhCurve: auto
          rejectUnauthorized: true
        upgradeSettings: {}
        upgradeGroupSettings:
          quantity: 100
          isRolling: true
          retryDelay: 1000
          retryCount: 5
        backups:
          backupsDirectory: $CRIBL_STATE_DIR/backups
          backupPersistence: 24h
        rollback:
          rollbackEnabled: true
    UpdateGitSettingsExamplesHttpsRemote:
      summary: Configure a remote Git repository over HTTPS
      description: Example request body for configuring a remote Git repository using
        HTTPS authentication.
      value:
        authType: https
        remote: https://github.com/example/config-repo.git
        user: git-user
        password: ghp_exampletoken
        gitOps: push
        defaultCommitMessage: Cribl config update
    UpdateGitSettingsExamplesSshRemote:
      summary: Configure a remote Git repository over SSH
      description: Example request body for configuring a remote Git repository using
        SSH key authentication.
      value:
        authType: ssh
        remote: git@github.com:example/config-repo.git
        sshKey: |-
          -----BEGIN OPENSSH PRIVATE KEY-----
          ...
          -----END OPENSSH PRIVATE KEY-----
        gitOps: push
        strictHostKeyChecking: true
        defaultCommitMessage: Cribl config update
    UpgradeFromPackageExamplesUpgradeWithPackage:
      summary: Upgrade Leader Node with a package
      description: Example request body for upgrading the Leader Node from a remote
        package URL.
      value:
        packages:
          - packageUrl: https://cdn.cribl.io/dl/4.10.0/cribl-4.10.0-abc12345-linux-x64.tgz
    VersionCommitExamplesCommitAll:
      summary: Commit all pending changes
      description: Example request body for committing all pending changes to the
        Cribl configuration.
      value:
        message: Updated pipeline configuration for syslog parsing
    VersionCommitExamplesCommitSpecificFiles:
      summary: Commit changes in specific files
      description: Example request body for committing a subset of configuration
        changes to specific files.
      value:
        message: Update Route and Pipeline for HTTP Sources
        effective: true
        files:
          - groups/default/local/cribl/pipelines/http_input/conf.yml
          - groups/default/local/cribl/routes.yml
    VersionRevertExamplesRevertCommit:
      summary: Revert a specific commit
      description: Example request body for reverting a specific commit.
      value:
        commit: a1b2c3d4e5f6
    VersionRevertExamplesForceRevertWithMessage:
      summary: Force revert a commit with a custom message
      description: Example request body for force reverting a specific commit that
        includes a custom message for the revert commit.
      value:
        commit: a1b2c3d4e5f6
        message: Revert commit due to misconfiguration in Pipeline settings
        force: true
    PostAiEventExamplesCopilotAnalyticsEvent:
      summary: Forward a Copilot analytics event to the Cribl AI backend
      description: Example request body for forwarding a Copilot analytics event to
        the Cribl AI events API.
      value:
        clientTimestamp: 1712345678901
        eventClass: click
        eventType: clickAIActivation
        conversationId: copilot-session-abc123
    UpdateAiFeaturesBulkExamplesMultipleFeatures:
      summary: Enable and disable multiple AI features
      description: Example request body for enabling and disabling multiple AI
        features in one request. Requires explicit consent to use AI features
        for the deployment (see <code>POST /ai/consent</code>).
      value:
        schematizer: true
        agentic_search: false
        web_search: true
        background_detection: true
    UpdateAiAgentsMdExamplesAgentsInstructions:
      summary: Replace agents.md content
      description: Example request body for replacing the content of the agents.md
        file for the specified Cribl product.
      value:
        content: |
          # Agents

          Use these guidelines when assisting users.
    SetAiCustomProviderExamplesBedrockProvider:
      summary: Configure an Amazon Bedrock custom AI Provider
      description: Example request body for configuring an Amazon Bedrock custom AI
        Provider. AWS region is based on the deployment's default region.
      value:
        id: my-bedrock
        name: bedrock
        description: Production Bedrock
        configuration:
          credential: REPLACE_WITH_BEDROCK_BEARER_TOKEN
    SetAiCustomProviderExamplesAzureOpenAIProvider:
      summary: Configure an Azure OpenAI-compatible custom AI Provider
      description: Example request body for configuring an Azure OpenAI-compatible
        custom AI Provider.
      value:
        id: my-azure-openai
        name: azure
        description: Azure OpenAI deployment
        configuration:
          credential: REPLACE_WITH_AZURE_OPENAI_API_KEY
          url: https://YOUR_RESOURCE_NAME.openai.azure.com/
    UpdateAiDatasetIntelligenceExamplesEditedSummary:
      summary: Replace dataset intelligence content
      description: Example request body for replacing the markdown content of an
        existing dataset intelligence file. Cannot be used while the file is in
        <code>processing</code> status.
      value:
        content: |
          # cribl_internal_logs

          ## Record families
          - ...
    UpdateAiFeatureExamplesEnableFeature:
      summary: Enable an AI feature
      description: Example request body for enabling a single AI feature. Use the
        <code>feature</code> path parameter to specify the feature to enable.
        Requires explicit consent to use AI features for the deployment (see
        <code>POST /ai/consent</code>).
      value:
        value: true
    UpdateAiConsentExamplesAcceptAi:
      summary: Consent to use AI features
      description: Example request body for explicitly consenting to use AI features
        for the deployment.
      value:
        accepted: true
    UpdateAiConsentExamplesDeclineAi:
      summary: Decline to use AI features
      description: Example request body for explicitly declining to use AI features
        for the deployment.
      value:
        accepted: false
    DsdAvailableLogSourcesResponseExamplesMerged:
      summary: Discovered log sources with configuration status
      description: Example response body that lists log sources from the latest Data
        Source Discovery (DSD) scan, showing whether each has been configured as
        a Cribl Source. Use <code>nextCursor</code> to paginate in subsequent
        requests.
      value:
        runTimestamp: 1737014400000
        loggingDestinationsArtifactFound: true
        discoveredDestinations:
          - destination_type: s3
            destination_arn: arn:aws:s3:::logs-bucket
            configurationStatus: configured
            matchedInputId: s3-in-1
          - destination_type: firehose
            destination_arn: arn:aws:firehose:us-east-1:123456789012:deliverystream/my-stream
            destination_http_endpoint_url: https://ingest.example.com:443
            configurationStatus: not_configured
    DsdErrorResponseExamplesBadRequest:
      summary: Bad request
      description: Validation failure or malformed input.
      value:
        message: Invalid request body
    DsdErrorResponseExamplesNotFound:
      summary: Not found
      description: Unknown resource or no data for the requested scope.
      value:
        message: Unknown connection id.
    DsdErrorResponseExamplesConflict:
      summary: Conflict
      description: Connection already exists for this account or organization.
      value:
        message: Connection already registered.
    DsdErrorResponseExamplesBadGateway:
      summary: Bad gateway
      description: Example response body when Cribl is unable to list or read
        configured cloud sources (for example, Leader configuration load
        failed).
      value:
        message: Unable to load cloud inputs. Try again later, or contact Cribl Support
          if the problem continues.
    DsdErrorResponseExamplesServiceUnavailable:
      summary: Service unavailable
      description: Data Source Discovery scanning is not available.
      value:
        message: Data Source Discovery scanning is not available. Try again later, or
          contact Cribl Support if the problem continues.
    DsdErrorResponseExamplesExternalIdMissing:
      summary: STS External ID missing from secure storage
      description: Example response body when the leader refuses to start a scan
        because the STS External ID for the resolved connection is missing from
        secure storage (for example after a migration gap).
      value:
        message: Data Source Discovery cannot start this scan because the STS External
          ID for this connection is missing from secure storage. Update the
          connection with a valid STS External ID or re-register the connection,
          or contact Cribl Support if the problem continues.
    DsdErrorResponseExamplesForbidden:
      summary: Forbidden
      description: Example response body when requester lacks permission for the
        operation (for example, to create Sources in the target Worker Group).
      value:
        message: Forbidden
    DsdErrorResponseExamplesLoggingDestinationsUnavailable:
      summary: Logging destinations storage error
      description: Example response body when the Leader could not read the scan
        results from storage.
      value:
        message: Failed to read logging destinations artifact
    DsdCfnReadPermissionsExamplesByConnectionId:
      summary: Generate template using stored connection and STS external id
      description: After POST /system/dsd/connections, pass the returned connection
        id. The leader loads the stored connection and the STS external id from
        secure storage and generates the bootstrap CloudFormation template.
      value:
        connectionId: f47ac10b-58cc-4372-a567-0e02b2c3d479
    DsdConfigureInputsResponseExamplesSuccess:
      summary: Artifacts and job identifiers returned
      description: Example 200 response after the blocking Firehose phase completes
        and the pull-phase job is enqueued. Poll
        <code>pullBatchConfigureJobId</code> at <code>GET
        /system/dsd/configure-inputs/jobs/{jobId}</code>.
      value:
        integrations:
          - source_service: cloudtrail
            source_kind: trail
            source_arn: arn:aws:cloudtrail:us-east-1:123456789012:trail/t
            log_category: management_events
            destination_type: s3
            destination_arn: arn:aws:s3:::logs-bucket
        artifacts:
          - kind: cloudformation
            generatorId: cfn-integration
            content: |
              AWSTemplateFormatVersion: "2010-09-09"
              Description: DSD integration
              Resources: {}
        pushBatchConfigureJobId: null
        pullBatchConfigureJobId: 6ba7b810-9dad-11d1-80b4-00c04fd430c8
        resourceSuffix: prod
        warnings:
          - New bucket ARNs exist only after stack deployment.
    DsdConfigureInputsRequestExamplesMinimalCloudTrail:
      summary: Configure inputs for CloudTrail with existing bucket
      description: "Example configure-inputs body: same integration row shape as
        CloudFormation integration generation, plus cloud scope and worker
        group."
      value:
        cloud: AWS
        accountId: "123456789012"
        groupId: default
        criblInputAssumeRolePrincipalArn: arn:aws:iam::000000000000:role/cribl-wg
        integrations:
          - source_service: cloudtrail
            source_kind: trail
            source_arn: arn:aws:cloudtrail:us-east-1:123456789012:trail/org-wide-audit
            log_category: management_and_data_events
            destination_type: s3
            destination_arn: arn:aws:s3:::org-cloudtrail-audit
            destination_name: org-cloudtrail-audit
    DsdConfigureInputsRequestExamplesWithPerRowUserParams:
      summary: Parallel userParams for S3 batch-configure
      description: Example request body for configuring inputs with per-integration
        user parameters for the S3 Source creation phase.
      value:
        cloud: AWS
        accountId: "123456789012"
        groupId: default
        integrations:
          - source_service: cloudtrail
            source_kind: trail
            source_arn: arn:aws:cloudtrail:us-east-1:123456789012:trail/t
            log_category: management_events
            destination_type: s3
            destination_arn: arn:aws:s3:::logs-bucket
        userParamsByIntegrationIndex:
          - id: dsd-s3-cloudtrail
            queueName: https://sqs.us-east-1.amazonaws.com/123456789012/dsd-queue
    DsdConnectionWriteResponseExamplesCreated:
      summary: Connection created
      description: Example response body when Data Source Discovery (DSD) connection
        is successfully registered.
      value:
        id: 8be4df61-93ca-11d2-aa0d-00e098032b8c
        connection:
          cloud: AWS
          kind: aws_account
          serviceRoleName: R
          accountId: "123456789012"
          connectedAt: 534679200
          lastDataScanAt: null
          lastOrgInventoryScanAt: null
    DsdConfigureInputsJobGetResponseExamplesInProgress:
      summary: Configure-inputs job in progress
      description: Same job payload as historic batch-configure polling; use the job
        id returned as <code>pullBatchConfigureJobId</code> or
        <code>pushBatchConfigureJobId</code> from POST configure-inputs.
      value:
        jobId: 6ba7b810-9dad-11d1-80b4-00c04fd430c8
        cloud: AWS
        accountId: "123456789012"
        status: running
        total: 2
        processed: 1
        results:
          - destination_arn: arn:aws:s3:::my-access-logs
            status: ok
            id: s3-logs-1
          - null
        createdAt: 2025-01-15T12:00:00.000Z
        updatedAt: 2025-01-15T12:00:01.000Z
    DsdConfigureInputsJobGetResponseExamplesDone:
      summary: Configure-inputs job completed
      description: Terminal job state with per-item Source creation results.
      value:
        jobId: 6ba7b810-9dad-11d1-80b4-00c04fd430c8
        cloud: AWS
        accountId: "123456789012"
        status: completed
        total: 2
        processed: 2
        results:
          - destination_arn: arn:aws:s3:::a
            status: ok
            id: s3-1
          - destination_arn: arn:aws:firehose:us-east-1:123456789012:deliverystream/dest
            source_arn: arn:aws:logs:us-east-1:123456789012:log-group:g
            status: error
            error:
              message: Could not resolve scan row for destination
              code: 400
        createdAt: 2025-01-15T12:00:00.000Z
        updatedAt: 2025-01-15T12:00:05.000Z
    DsdListConnectionsResponseExamplesSample:
      summary: List of connections
      description: Example response body that lists all registered Data Source
        Discovery (DSD) connections. Responses include persisted connection
        fields only; <code>stsExternalId</code> is never returned. Scans resolve
        the STS External ID server-side from secure storage.
      value:
        connections:
          8be4df61-93ca-11d2-aa0d-00e098032b8c:
            cloud: AWS
            kind: aws_account
            serviceRoleName: R
            accountId: "123456789012"
            connectedAt: 534679200
            lastDataScanAt: null
            lastOrgInventoryScanAt: null
    DsdAsyncAcceptedResponseExamplesScanStarted:
      summary: Scan accepted
      description: 202 response after accepting a data scan.
      value:
        message: Scan started
    DsdAsyncAcceptedResponseExamplesOrgInventoryStarted:
      summary: Org inventory accepted
      description: 202 response after accepting an org inventory scan.
      value:
        message: Org inventory scan started
    DsdOrgInventoryScanExamplesByConnectionId:
      summary: Org inventory scan
      description: Trigger org inventory for an existing connection id. The STS
        External ID is not part of this body; the leader loads it from secure
        storage for that connection before invoking the scanner.
      value:
        connectionId: 8be4df61-93ca-11d2-aa0d-00e098032b8c
    DsdRegisterConnectionExamplesAwsAccount:
      summary: Register a single AWS account
      description: Example request body for registering a single AWS account
        connection for Data Source Discovery (DSD).
      value:
        cloud: AWS
        kind: aws_account
        accountId: "123456789012"
        serviceRoleName: CriblDsdServiceRole
    DsdRegisterConnectionExamplesAwsOrganization:
      summary: Register an AWS Organization
      description: Example request body for registering an AWS Organizations
        connection for Data Source Discovery (DSD).
      value:
        cloud: AWS
        kind: aws_organization
        accountId: "123456789012"
        organizationalUnitIds:
          - r-abcd12
          - ou-abcd-12345678
          - ou-ijkl-87654321
        accountFilterType: NONE
        serviceRoleName: CriblDsdOrgRole
    DsdDataScanExamplesMinimalAccountScan:
      summary: Scan a single AWS account with default settings
      description: Example request body for scanning a single AWS account for log
        sources using default settings. The STS External ID is not part of this
        body; the leader resolves it from secure storage for the matching
        connection before invoking the scanner.
      value:
        cloud: AWS
        accountId: "123456789012"
    DsdDataScanExamplesWithRegionsAndServices:
      summary: Scan a single AWS account with optional filters
      description: Example request body for scanning a single AWS account for log
        sources using optional <code>regions</code> and <code>services</code>
        body parameters for filtering. The STS External ID is not part of this
        body; the leader resolves it from secure storage for the matching
        connection before invoking the scanner.
      value:
        cloud: AWS
        accountId: "123456789012"
        organizationId: "123456789012"
        region: us-east-1
        regions:
          - us-east-1
          - us-west-2
        services:
          - service: s3
            regions:
              - us-east-1
            rate: 10
          - service: lambda
            regions:
              - us-west-2
    DsdStatusResponseExamplesRunning:
      summary: Scan running
      description: Progress while scanner work is in flight.
      value:
        percentComplete: 42
        estimatedTimeRemainingSeconds: 120
        runTimestamp: 1737014400
        phase: running
    DsdStatusResponseExamplesFailed:
      summary: Scan failed
      description: Terminal failure; internal scanner diagnostics are not included.
      value:
        phase: failed
        error: Scan failed. Please ensure that you have applied the Cloudformation to
          grant the scanner permission to access your account. If the problem
          persists, please contact Cribl support.
    DsdUpdateConnectionExamplesAwsAccount:
      summary: Update an AWS account connection
      description: Example request body for updating an existing AWS account
        connection for Data Source Discovery (DSD).
      value:
        kind: aws_account
        serviceRoleName: CriblDsdServiceRole
        displayName: Production account
    DsdUpdateConnectionExamplesAwsOrganization:
      summary: Update an AWS Organizations connection
      description: Example request body for updating an existing AWS Organizations
        connection for Data Source Discovery (DSD).
      value:
        kind: aws_organization
        serviceRoleName: CriblDsdOrgRole
        displayName: Org root and OUs
        accountId: "123456789012"
        organizationalUnitIds:
          - r-abcd12
          - ou-abcd-12345678
        accountFilterType: NONE
    LakeSourceCreateExamplesDdssSource:
      summary: Create a DDSS Cribl Lake Source
      description: Example request body for creating a DDSS Cribl Lake Source (bucket)
        in the specified Lake.
      value:
        id: my_ddss_bucket
        sourceType: ddss
        name: my_ddss_bucket
        type: ddss
        region: us-east-1
        credentials:
          method: auto
    LakeSourceCreateExamplesHttpSource:
      summary: Create a Direct Access HTTP Cribl Lake Source
      description: Example request body for creating a Direct Access HTTP Cribl Lake
        Source in the specified Lake.
      value:
        id: default
        sourceType: http
        authTokens:
          - token: my_ingest_token_001
            description: Primary ingest token for NDJSON data
    LakeSourceUpdateExamplesUpdateDdssSource:
      summary: Update a DDSS Cribl Lake Source
      description: Example request body for updating a DDSS Cribl Lake Source (bucket)
        in the specified Lake.<br/><br/>The request body must include a complete
        representation of the Cribl Lake Source that you want to update. This
        endpoint does not support partial updates.
      value:
        id: my_ddss_bucket
        sourceType: ddss
        name: my_ddss_bucket
        type: ddss
        region: us-east-1
        description: Production DDSS bucket
        credentials:
          method: auto
    LakeSourceUpdateExamplesUpdateHttpSource:
      summary: Update a Direct Access HTTP Cribl Lake Source
      description: Example request body for updating a Direct Access HTTP Cribl Lake
        Source in the specified Lake.
      value:
        id: default
        sourceType: http
        authTokens:
          - token: updated_ingest_token
            description: Rotated ingest token
    DatatypePreviewResponseExamplesWithEvents:
      summary: Preview event breaker with matched events
      description: Example response body that contains a preview for an event breaker
        that produced matching events.
      value:
        count: 2
        events:
          - _raw:
              host: web01
              status: 200
            _time: 1705312800
          - _raw:
              host: web02
              status: 404
            _time: 1705312801
        processingTimeMS: 42
        useFormattedVisualization: false
    DatatypePreviewResponseExamplesNoEvents:
      summary: Preview event breaker with no matched events
      description: Example response body that contains a preview for an event breaker
        that did not produce matching events. The <code>events</code> array is
        empty and the <code>count</code> value is zero.
      value:
        count: 0
        events: []
        processingTimeMS: 5
        useFormattedVisualization: false
    DatatypePreviewRequestExampleDatasetWithRegexBreaker:
      summary: Preview a regex Event Breaker against Dataset sample rows
      description: Example request body for previewing a regex Event Breaker from
        <code>input.dataset</code> using a single regex Event Breaker rule. The
        rule splits on syslog-style line starts and uses automatic timestamp
        extraction within the first <code>timestamp.length</code> characters.
      value:
        input:
          type: dataset
          dataset: my_s3_dataset
        eventBreakerRule:
          name: syslog-line-break
          condition: "true"
          type: regex
          eventBreakerRegex: /^\w{3}\s+\d+\s+\d+:\d+:\d+/m
          timestampAnchorRegex: /^/
          timestampTimezone: UTC
          timestamp:
            type: auto
            length: 150
          maxEventBytes: 51200
    DatatypePreviewRequestExampleDatasetDefaultBreakers:
      summary: Preview using only the Dataset Event Breakers
      description: Example request body for previewing with only the Dataset Event
        Breakers.The preview uses the default Event Breaker configuration (no ad
        hoc rule overlay).
      value:
        input:
          type: dataset
          dataset: my_s3_dataset
    SearchLakeDestinationsListExamplesDataLakeS3:
      summary: Data Lake Amazon S3 Destination object
      description: Example object representing a Data Lake Amazon S3 Destination.
      value:
        id: lake-orders
        type: dl_s3
        bucket: company-lake
        stagePath: /tmp/cribl-staging
        region: us-east-1
        group: default
    CreateSearchNotificationExamplesScheduledSearchNotify:
      summary: Forward a Search Notification
      description: Example request body for forwarding a search Notification to the
        Notification server for delivery to configured Notification targets. The
        <code>POST /search/notifications</code> endpoint is called internally by
        scheduled search jobs when their results match the triggering conditions
        for a Notification.
      value:
        id: SEARCH_NOTIFICATION_notif-id_1710000000000
        severity: info
        _raw: Search job completed.
        title: Scheduled search notification
        _time: 1710000000000
        now: 1710000000000
        group: default_search
        searchId: search-job-id
        savedQueryId: saved-query-id
        searchResultsUrl: https://example.cribl.cloud/search/search-job-id
        notificationId: notif-id
        tenantId: tenant-id
        message: Search job completed.
        __attachments: []
        origin_metadata:
          itemType: link
          id: search-job-id
          type: search
          product: search
          groupId: ""
    CreateSearchNotificationExamplesWithResultSet:
      summary: Notify payload including inline results
      description: When include-results is enabled, resultSet contains truncated
        search result rows.
      value:
        id: SEARCH_NOTIFICATION_notif-id_1710000000001
        severity: info
        _raw: Results ready.
        title: Scheduled search notification
        _time: 1710000000001
        now: 1710000000001
        group: default_search
        searchId: search-job-id
        savedQueryId: saved-query-id
        searchResultsUrl: https://example.cribl.cloud/search/search-job-id
        notificationId: notif-id
        tenantId: tenant-id
        message: Results ready.
        __attachments: []
        origin_metadata:
          itemType: link
          id: search-job-id
          type: search
          product: search
          groupId: ""
        resultSet:
          - _time: 1710000000
            host: host-1
    SearchPreviewRequestExamplesMinimal:
      summary: Preview with a simple query and two sample events
      description: Example request body for previewing a minimal valid body, a Kusto
        snippet in <code>query</code> and one or more objects in
        <code>events</code>. Each event typically includes <code>_time</code>
        and fields the query references.
      value:
        query: '| where host == "web-01"'
        events:
          - _time: 1704067200000
            host: web-01
            severity: info
            _raw:
              message: GET /api/v1/health 200
          - _time: 1704067260000
            host: web-02
            severity: warn
            _raw:
              message: slow query detected
    SearchPreviewRequestExamplesWithTimeBounds:
      summary: Preview with defined time range
      description: Extends the minimal preview example by adding
        <code>options.earliest</code> and <code>options.latest</code>. These
        fields bound the search window and accept either relative time strings
        (e.g., "-1h") or epoch timestamps.
      value:
        query: dataset="app_logs" | where severity == "error" | limit 10
        events:
          - _time: 1704067200000
            host: api-01
            severity: error
            _raw:
              message: connection refused upstream
        options:
          earliest: -24h
          latest: now
    SearchVpcEndpointIdsListExamplesMultipleRegions:
      summary: Multiple S3 interface VPC endpoint IDs
      description: Example response body listing multiple S3 interface VPC endpoint
        IDs resolved for AWS regions where Cribl Search runs.
      value:
        - vpce-0123456789abcdef0
        - vpce-0fedcba9876543210
        - vpce-0abc123def4567890
    SearchVpcEndpointIdsListExamplesSingleRegion:
      summary: Single S3 interface VPC endpoint ID
      description: Example response body listing a single S3 interface VPC endpoint ID
        when only one resolved endpoint is returned.
      value:
        - vpce-0123456789abcdef0
    DatasetStatsExamplesOneDayHourly:
      summary: Dataset statistics over a 1-day window with hourly granularity
      description: Example response body with Dataset statistics over a 24-hour window
        with 1-hour buckets showing event and byte counts.
      value:
        minEventTime: 1700000000000
        maxEventTime: 1700086400000
        totalEventCount: 524800
        totalByteCount: 268369920
        eventCounts:
          - startTime: 1700000000000
            endTime: 1700003600000
            value: 21200
          - startTime: 1700003600000
            endTime: 1700007200000
            value: 23400
        byteCounts:
          - startTime: 1700000000000
            endTime: 1700003600000
            value: 10854400
          - startTime: 1700003600000
            endTime: 1700007200000
            value: 11980800
    DatasetStatsError400ExamplesInvalidQueryParams:
      summary: Invalid query parameters
      description: Example error response body for a request with invalid query
        parameters, such as a non-integer <code>startTime</code> or
        <code>granularity</code> that exceeds the time range.
      value:
        status: error
        message: startTime must be non-negative integer
    DatasetStatsError404ExamplesDatasetNotFound:
      summary: Nonexistent lakehouse engine Dataset
      description: Example error response body for a request whose specified Dataset
        does not exist or is not a Cribl lakehouse engine Dataset.
      value:
        status: error
        message: Local Search dataset 'my_dataset' does not exist
    DatasetUsageStatsExamplesLast24Hours:
      summary: Usage statistics for 24-hour window with hourly granularity
      description: Example response body that includes Dataset usage statistics over a
        24-hour window with query counts broken out by type, top users, and last
        query time.
      value:
        queryCounts:
          - startTime: 1700000000000
            counts:
              - type: standard
                count: 12
              - type: scheduled
                count: 4
          - startTime: 1700003600000
            counts:
              - type: standard
                count: 8
              - type: dashboard
                count: 2
        topUsers:
          - user: admin
            userDisplayName: Admin User
            queryCount: 45
          - user: analyst1
            userDisplayName: Jane Doe
            queryCount: 28
        lastQueryTime: 1700086200000
    DatasetUsageStatsError400ExamplesInvalidParams:
      summary: Time window out of range or not aligned to a whole minute
      description: Example error response body when the specified
        <code>timeWindow</code> value is out of range or is not a multiple of 1
        whole minute.<br/><br/>A <code>granularity</code> value that is out of
        range or is not a multiple of 1 whole minute results in a similar error
        message.
      value:
        status: error
        message: Time window must be an integer in ms (1 to 30 days), multiple of one
          minute
    FieldStatsExamplesMixedFields:
      summary: Field statistics for string and numeric fields
      description: Example response body that includes total event count and per-field
        statistics for top values, unique counts, and numeric summaries (min,
        max, average, standard deviation, and bucketed averages).
      value:
        totalEventCount: 524800
        fieldStats:
          - name: host
            count: 524800
            nullCount: 0
            uniqueCount: 42
            topValues:
              - value: web-prod-01
                count: 131200
              - value: web-prod-02
                count: 118100
            valueTypes:
              object: false
              array: false
              boolean: false
              numeric: false
            type: string
            emptyCount: 0
          - name: duration_ms
            count: 480000
            nullCount: 44800
            uniqueCount: 3200
            topValues:
              - value: "200"
                count: 12400
              - value: "150"
                count: 11800
            valueTypes:
              object: false
              array: false
              boolean: false
              numeric: true
            type: numeric
            min: 1
            max: 9800
            avg: 245.3
            stdDev: 412.7
            avgValues:
              - startTime: 1700000000000
                endTime: 1700003600000
                value: 238.1
              - startTime: 1700003600000
                endTime: 1700007200000
                value: 252.5
    FieldStatsError400ExamplesInvalidQueryParams:
      summary: Invalid query parameters
      description: Example error response body for a request with invalid query
        parameters, such as an <code>endTime</code> that is earlier than the
        <code>startTime</code>.
      value:
        status: error
        message: endTime must be greater than startTime
    LocalSearchDeployExamplesDeployedWorkerGroup:
      summary: Deployment metadata for lakehouse service
      description: Example response body for deploying the lakehouse service configuration.
      value:
        id: search
        name: search
        type: local_search
        onPrem: false
        configVersion: "1700000000000"
        streamtags: []
        workerRemoteAccess: true
        provisioned: true
        cloud:
          provider: aws
          region: us-west-2
        estimatedIngestRate: 1024
    LocalSearchGetStatusExamplesWithEngines:
      summary: Lakehouse service status with one active engine.
      description: Example response body for lakehouse service status with one active
        lakehouse engine.
      value:
        status: ready
        enabled: true
        estimatedIngestRate: 2048
        engines:
          - id: engine_main_001
            engineType: local
            tierSize: medium
            status: ready
            lastProvisionedMs: 1700000000000
    LocalSearchGetStatusExamplesNoEngines:
      summary: Lakehouse serivce status with no active engines
      description: Example response body for lakehouse service status with no active
        lakehouse engines (empty <code>engines</code> array).
      value:
        status: provisioning
        enabled: true
        estimatedIngestRate: 1024
        engines: []
    LocalSearchInfraSyncExamplesActiveEngines:
      summary: Operator-only lakehouse service infrastructure sync payload
      description: Example response body for operator-only lakehouse service
        infrastructure sync payload when at least one lakehouse engine is
        active.
      value:
        worker:
          estimatedIngestGB: 1024
        storage:
          - engineId: engine_main_001
            tierSize: medium
    LocalSearchInfraSyncExamplesClearInfrastructure:
      summary: Operator-only lakehouse service infrastructure sync payload signaling
        cleanup
      description: Example response body for operator-only lakehouse service
        infrastructure sync payload when the lakehouse service is disabled or
        there are no active engines. Orchestration should tear down worker and
        storage resources.
      value:
        storage: []
    LocalSearchCaptureNdjsonResponseExamplesSampleEventLine:
      summary: One captured event
      description: Example response body for one captured event for a streaming
        lakehouse engine. Each line represents one event.
      value:
        _raw: sample event payload
        _time: 1700000000
    LocalSearchCaptureExamplesAtSource:
      summary: Start a level 0 capture with captureId specified
      description: Example request body for starting a level 0 capture for all events
        from all configured lakehouse engine Sources and a
        <code>captureId</code> to use for the <code>POST
        /search/local_search/capture/stop</code> endpoint.
      value:
        filter: "true"
        maxEvents: 100
        duration: 30
        level: 0
        captureId: 550e8400-e29b-41d4-a716-446655440000
    LocalSearchCaptureExamplesAfterDatatyping:
      summary: Start a level 1 capture with a draft Datatype ruleset
      description: Example request body for starting a level 1 capture of events after
        Datatype processing. The capture uses the draft (in-progress and
        unsaved) Datatype ruleset to allow a live preview of the results.
      value:
        filter: "true"
        maxEvents: 50
        duration: 15
        level: 1
        datatypeRuleset:
          id: draft
          rules: []
    LocalSearchCaptureExamplesAfterDatasetDetection:
      summary: Start a level 2 capture with draft Datatype and Dataset rulesets
      description: Example request body for starting a level 2 capture of events after
        Dataset detection. The capture uses the draft (in-progress and unsaved)
        Datatype and Dataset rulesets to allow a live preview of the results.
      value:
        filter: "true"
        maxEvents: 50
        duration: 15
        level: 2
        datatypeRuleset:
          id: draft
          rules: []
        datasetRuleset:
          id: draft
          rules: []
    LocalSearchCaptureStopExamplesById:
      summary: Stop an active capture
      description: Example request body for stopping a capture using the
        <code>captureId</code>.
      value:
        captureId: 550e8400-e29b-41d4-a716-446655440000
    LocalSearchSourceCountedResponseExamplesSingleSource:
      summary: Single lakehouse engine Source
      description: Example response body that shows a list containing a single
        lakehouse engine Source object.
      value:
        count: 1
        items:
          - id: in_cribl_http_1
            type: cribl_http
            host: 0.0.0.0
            port: 10200
            description: Primary Cribl HTTP ingest for the Worker Group
            tls:
              disabled: false
              minVersion: TLSv1.3
    LocalSearchSourceCreateExamplesCriblHttp:
      summary: Create a Cribl HTTP lakehouse engine Source
      description: Example request body for creating a lakehouse engine Source that
        listens for Cribl HTTP events.
      value:
        id: in_cribl_http_1
        type: cribl_http
        host: 0.0.0.0
        port: 10200
        tls:
          disabled: false
          minVersion: TLSv1.3
    LocalSearchSourceCreateExamplesCriblHttpWithDescription:
      summary: Create a Cribl HTTP lakehouse engine Source with description
      description: Example request body for creating a Cribl HTTP lakehouse engine
        Source with an optional description.
      value:
        id: in_cribl_http_primary
        type: cribl_http
        host: 0.0.0.0
        port: 10200
        description: Primary Cribl HTTP ingest for the Worker Group
        tls:
          disabled: false
          minVersion: TLSv1.3
    LocalSearchSourceCreateExamplesSplunkHec:
      summary: Create a Splunk HEC lakehouse engine Source
      description: Example request body for creating a lakehouse engine Source that
        listens for Splunk HTTP Event Collector (HEC) events.
      value:
        id: in_splunk_hec_1
        type: splunk_hec
        host: 0.0.0.0
        port: 8088
        splunkHecAPI: /services/collector
    LocalSearchSourceCreateExamplesSyslogTcp:
      summary: Create a Syslog lakehouse engine Source
      description: Example request body for creating a Syslog lakehouse engine Source
        that listens on TCP.
      value:
        id: in_syslog_1
        type: syslog
        host: 0.0.0.0
        tcpPort: 601
    LocalSearchSourceUpdateExamplesCriblHttp:
      summary: Update a Cribl HTTP lakehouse engine Source
      description: Example request body for updating the description for an existing
        Cribl HTTP lakehouse engine Source.<br/><br/>The request body must
        include a complete representation of the lakehouse engine Source that
        you want to update. This endpoint does not support partial updates.
      value:
        id: in_cribl_http_1
        type: cribl_http
        host: 0.0.0.0
        port: 10200
        description: Ingest from connected Worker Group
        tls:
          disabled: false
          minVersion: TLSv1.3
    LocalSearchSourceUpdateExamplesSplunkHec:
      summary: Update a Syslog lakehouse engine Source to enable UDP
      description: Example request body for updating a Syslog lakehouse engine Source
        to add a UDP port.<br/><br/>The request body must include a complete
        representation of the lakehouse engine Source that you want to update.
        This endpoint does not support partial updates.
      value:
        id: in_splunk_hec_1
        type: splunk_hec
        host: 0.0.0.0
        port: 8088
        splunkHecAPI: /services/collector/event
        splunkHecAcks: true
    LocalSearchSourceUpdateExamplesSyslogTcp:
      summary: Add a UDP listen port to a Syslog source.
      description: Example request body for enabling UDP on an existing Syslog Local
        Search source.
      value:
        id: in_syslog_1
        type: syslog
        host: 0.0.0.0
        tcpPort: 601
        udpPort: 514
security:
  - bearerAuth: []
tags:
  - name: aetos
    description: Actions related to Aetos
    x-cribl-internal: true
    x-cribl-availability: both
  - name: AI
    description: Actions related to AI
    x-cribl-internal: true
    x-cribl-availability: both
  - name: ai-settings
    description: Actions related to AI settings, AI features, agents.md
      instructions, and custom AI Provider configuration.
    x-cribl-availability: both
  - name: apps
    description: Actions related to Apps
    x-cribl-availability: both
  - name: appscope-configs
    description: Actions related to Appscope Configs
    x-cribl-availability: both
  - name: auth
    description: Actions related to authentication. Do not use the /auth endpoints
      in Cribl.Cloud deployments. Instead, follow the instructions at
      https://docs.cribl.io/stream/api-tutorials/#criblcloud to authenticate for
      Cribl.Cloud.
    x-cribl-availability: both
  - name: authorize
    description: Actions related to Authorize
    x-cribl-availability: both
  - name: banners
    description: Actions related to Banners
    x-cribl-availability: both
  - name: certificates
    description: Actions related to Certificates
    x-cribl-availability: both
  - name: changelog
    description: Actions related to Changelog
    x-cribl-internal: true
    x-cribl-availability: both
  - name: click-house
    description: Actions related to ClickHouse
    x-cribl-availability: both
  - name: clui
    description: Actions related to CLUI
    x-cribl-internal: true
    x-cribl-availability: both
  - name: collectors
    description: Actions related to Collectors
    x-cribl-availability: both
  - name: compute-fleets
    description: Actions related to Compute Fleets
  - name: conditions
    description: Actions related to Conditions
    x-cribl-availability: both
  - name: configProfiles
    description: Actions related to ConfigProfiles
    x-cribl-internal: true
    x-cribl-availability: both
  - name: consent
    description: Actions related to AI feature consent for the deployment.
    x-cribl-availability: both
  - name: credentials
    description: Actions related to Credentials
    x-cribl-availability: cloud
  - name: dashboardCategories
    description: Actions related to Dashboard Collections
    x-cribl-availability: both
  - name: dashboards
    description: Actions related to Dashboards
  - name: data-source-discovery
    description: Actions related to automated data source discovery and
      configuration features.
    x-cribl-availability: cloud
  - name: databaseConnections
    description: Actions related to DatabaseConnections
    x-cribl-availability: both
  - name: datasets
    description: Actions related to Datasets
    x-cribl-availability: cloud
  - name: datatypes
    description: Actions related to Datatypes
    x-cribl-availability: cloud
  - name: destinations
    description: Actions related to Destinations
    x-cribl-availability: both
  - name: diag
    description: Actions related to diagnostics
    x-cribl-availability: both
  - name: distributed
    description: Actions related to Distributed
    x-cribl-availability: both
  - name: edge
    description: Actions enabled in Edge
    x-cribl-availability: both
  - name: edgeAppScopeProcesses
    description: Actions related to Edge AppScope processes
    x-cribl-availability: both
  - name: edgeContainers
    description: Actions related to Edge containers
    x-cribl-internal: true
    x-cribl-availability: both
  - name: edgeEvents
    description: Actions related to EdgeEvents
    x-cribl-internal: true
    x-cribl-availability: both
  - name: edgeLs
    description: Actions related to Edge listing
    x-cribl-internal: true
    x-cribl-availability: both
  - name: edgeProcesses
    description: Actions related to Edge processes
    x-cribl-internal: true
    x-cribl-availability: both
  - name: eventBreakerRules
    description: Actions related to Event Breaker rules
    x-cribl-availability: both
  - name: executors
    description: Actions related to Executors
    x-cribl-availability: both
  - name: expressions
    description: Actions related to expressions
    x-cribl-availability: both
  - name: features
    description: Actions related to Features
    x-cribl-internal: true
    x-cribl-availability: both
  - name: functions
    description: Actions related to functions
    x-cribl-availability: both
  - name: git
    description: Actions related to Git
    x-cribl-availability: both
  - name: globalVariables
    description: Actions related to Global Variables
    x-cribl-availability: both
  - name: grokfiles
    description: Actions related to Grok files
    x-cribl-availability: both
  - name: groups
    description: Actions related to Groups
    x-cribl-availability: both
  - name: health
    description: Actions related to REST server health
    x-cribl-availability: both
  - name: hmacFunctions
    description: Actions related to HMAC functions
    x-cribl-availability: both
  - name: insights
    description: Actions related to Insights
    x-cribl-internal: true
    x-cribl-availability: cloud
  - name: iometrics
    description: Actions related to source/destination metrics
    x-cribl-internal: true
    x-cribl-availability: both
  - name: jobs
    description: Actions related to Jobs
    x-cribl-availability: both
  - name: keys
    description: Actions related to encryption keys
    x-cribl-availability: both
  - name: kube-logs
    description: Actions related to Kube Logs
    x-cribl-internal: true
    x-cribl-availability: both
  - name: kube-proxy
    description: Actions related to Kube Proxy
    x-cribl-internal: true
    x-cribl-availability: both
  - name: lake
    description: Actions related to Lake
    x-cribl-availability: cloud
  - name: licenses
    description: Actions related to licenses. The <code>/licenses</code> endpoints
      do not apply to Cribl.Cloud deployments.
    x-cribl-availability: onprem
  - name: logger
    description: Actions related to Logger
    x-cribl-internal: true
    x-cribl-availability: both
  - name: logging
    description: Actions related to logging
    x-cribl-internal: true
    x-cribl-availability: both
  - name: lookups
    description: Actions related to lookups
    x-cribl-availability: both
  - name: macros
    description: Actions related to Macros
    x-cribl-availability: cloud
  - name: mappings
    description: Actions related to Mappings
    x-cribl-availability: both
  - name: messages
    description: Actions related to messages
    x-cribl-availability: both
  - name: metrics
    description: Actions related to metrics
    x-cribl-availability: both
  - name: monitors
    description: Actions related to Monitors
    x-cribl-internal: true
    x-cribl-availability: both
  - name: notebook-templates
    description: Actions related to Notebook Templates
  - name: notebooks
    description: Actions related to Notebooks
  - name: notification-targets
    description: Actions related to Notification Targets
    x-cribl-availability: both
  - name: notifications
    description: Actions related to Notifications
    x-cribl-availability: both
  - name: outpost
    description: Actions related to Outpost
    x-cribl-availability: both
  - name: overlay
    description: Actions related to Overlay
    x-cribl-internal: true
    x-cribl-availability: both
  - name: packs
    description: Actions related to Packs
    x-cribl-availability: both
  - name: parquetschemas
    description: Actions related to Parquet schemas
    x-cribl-availability: both
  - name: parsers
    description: Actions related to parsers
    x-cribl-availability: both
  - name: pipelines
    description: Actions related to Pipelines
    x-cribl-availability: both
  - name: policies
    description: Actions related to Policies
    x-cribl-availability: both
  - name: pqorphanmanagement
    description: Actions related to Pqorphanmanagement
    x-cribl-availability: both
  - name: pqstorage
    description: Actions related to persistent queue (PQ) storage configuration
    x-cribl-availability: both
  - name: preview
    description: Actions related to data preview
    x-cribl-availability: both
  - name: processes
    description: Actions related to Processes
    x-cribl-internal: true
    x-cribl-availability: both
  - name: profiler
    description: Actions related to Profiler
    x-cribl-availability: both
  - name: projects
    description: Actions related to Projects
    x-cribl-availability: both
  - name: protobuflibraries
    description: Actions related to Protobuf libraries
    x-cribl-availability: both
  - name: provisioning-tokens
    description: Actions related to provisioning token management
    x-cribl-availability: both
  - name: query
    description: Actions related to Query
    x-cribl-internal: true
    x-cribl-availability: cloud
  - name: regexes
    description: Actions related to regular expressions
    x-cribl-availability: both
  - name: roles
    description: Actions related to Roles
    x-cribl-availability: both
  - name: routes
    description: Actions related to Routes
    x-cribl-availability: both
  - name: samples
    description: Actions related to samples
    x-cribl-availability: both
  - name: savedQueries
    description: Actions related to saved queries
    x-cribl-availability: cloud
  - name: schemas
    description: Actions related to Schemas
    x-cribl-availability: both
  - name: scripts
    description: Actions related to scripts
    x-cribl-availability: onprem
  - name: sds-rulesets
    description: Actions related to Sds Rulesets
    x-cribl-availability: both
  - name: sdsRules
    description: Actions related to SdsRules
    x-cribl-availability: both
  - name: search
    description: Actions related to Search
  - name: searchNotifications
    description: Actions related to SearchNotifications
    x-cribl-availability: cloud
  - name: secretFolders
    description: Actions related to SecretFolders
    x-cribl-internal: true
    x-cribl-availability: both
  - name: secrets
    description: Actions related to Secrets
    x-cribl-availability: both
  - name: secretStores
    description: Actions related to SecretStores
    x-cribl-internal: true
    x-cribl-availability: both
  - name: security
    description: Actions related to Security
    x-cribl-availability: both
  - name: sharedConfigs
    description: Actions related to SharedConfigs
    x-cribl-internal: true
    x-cribl-availability: both
  - name: sources
    description: Actions related to Sources
    x-cribl-availability: both
  - name: subscriptions
    description: Actions related to Subscriptions
    x-cribl-availability: both
  - name: system
    description: Actions related to system settings
    x-cribl-availability: both
  - name: system-insights
    description: Actions related to System Insights
    x-cribl-internal: true
    x-cribl-availability: both
  - name: teams
    description: Actions related to Teams
    x-cribl-availability: both
  - name: trust-policies
    description: Actions related to Trust Policies
    x-cribl-internal: true
    x-cribl-availability: cloud
  - name: uiState
    description: Actions related to UiState
    x-cribl-internal: true
    x-cribl-availability: both
  - name: usage-groups
    description: Actions related to Usage Groups
    x-cribl-internal: true
    x-cribl-availability: cloud
  - name: users
    description: Actions related to users. The <code>/system/users</code> endpoints
      do not apply to Cribl.Cloud deployments. Instead use
      <code>/products/{product}/users</code>
  - name: versioning
    description: Actions related to Versioning
    x-cribl-availability: both
  - name: workers
    description: Actions related to Workers
    x-cribl-availability: both
paths:
  /products/aetos/prom/-/healthy:
    get:
      operationId: getProductsAetosPromHealthy
      tags:
        - aetos
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Check if Aetos is healthy
      description: Prometheus-compatible health check. Returns 200 if the Aetos
        service process is alive.
      security: []
      responses:
        "200":
          description: Aetos is healthy
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/projects:
    get:
      operationId: listProject
      deprecated: true
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - projects
      summary: Get a list of Project objects
      description: Get a list of Project objects.
      responses:
        "200":
          description: List of Project objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProjectConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createProject
      deprecated: true
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - projects
      summary: Create Project
      description: Create Project.
      requestBody:
        description: New Project object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProjectConfig"
      responses:
        "200":
          description: The created Project object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProjectConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/projects/{id}:
    get:
      operationId: getProjectById
      deprecated: true
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - projects
      summary: Get Project by ID
      description: Get Project by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Project objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProjectConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateProjectById
      deprecated: true
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - projects
      summary: Update Project
      description: Update Project.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to PATCH
      requestBody:
        description: Project object to be updated.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProjectConfig"
      responses:
        "200":
          description: The updated Project object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProjectConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteProjectById
      deprecated: true
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - projects
      summary: Delete Project
      description: Delete Project.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted Project object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProjectConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/projects/{id}/acl:
    get:
      operationId: getProjectAclById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: both
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Get
      description: List accesses to Project granted to users.
      summary: Get Project ACL
      tags:
        - projects
  /system/projects/{id}/acl/apply:
    post:
      operationId: createProjectAclApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclApplyProjectExamplesGrantAccess:
                $ref: "#/components/examples/AclApplyProjectExamplesGrantAccess"
              AclApplyProjectExamplesRevokeAccess:
                $ref: "#/components/examples/AclApplyProjectExamplesRevokeAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: both
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Create
      description: Add/remove accesses to Project for users.
      summary: Modify Project ACL
      tags:
        - projects
  /system/projects/{id}/acl/teams:
    get:
      operationId: getProjectAclTeamsById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: both
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Get
      description: List accesses to Project granted to Teams.
      summary: Get Project Teams
      tags:
        - projects
  /system/projects/{id}/acl/teams/apply:
    post:
      operationId: createProjectAclTeamsApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclTeamsApplyProjectExamplesGrantTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyProjectExamplesGrantTeamAccess"
              AclTeamsApplyProjectExamplesRevokeTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyProjectExamplesRevokeTeamAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: both
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Create
      description: Add/remove accesses to Project for Teams.
      summary: Modify Project Teams ACL
      tags:
        - projects
  /system/projects/{projectId}/destinations:
    get:
      operationId: getProjectDestinationsByProjectId
      tags:
        - projects
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List Project Destinations
      description: Lists destinations associated with this project.
      deprecated: true
      responses:
        "200":
          description: List of ProjectDestination objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProjectDestination"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: Project Id
  /system/subscriptions:
    get:
      operationId: listSubscription
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - subscriptions
      summary: Get a list of Subscription objects
      description: Get a list of Subscription objects.
      responses:
        "200":
          description: List of Subscription objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSubscription"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createSubscription
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - subscriptions
      summary: Create a Subscription
      description: Create a new Subscription.
      requestBody:
        description: Subscription object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Subscription"
            examples:
              CreateSubscriptionExamplesBasicSubscription:
                $ref: "#/components/examples/CreateSubscriptionExamplesBasicSubscription"
      responses:
        "200":
          description: The created Subscription object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSubscription"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/subscriptions/{id}:
    get:
      operationId: getSubscriptionById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - subscriptions
      summary: Get Subscription by ID
      description: Get Subscription by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Subscription objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSubscription"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSubscriptionById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - subscriptions
      summary: Update a Subscription
      description: Update the specified Subscription.<br/><br/>Provide a complete
        representation of the Subscription that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the
        Subscription.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated Subscription might not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Subscription to update.
      requestBody:
        description: Subscription object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Subscription"
            examples:
              UpdateSubscriptionExamplesUpdateSubscription:
                $ref: "#/components/examples/UpdateSubscriptionExamplesUpdateSubscription"
      responses:
        "200":
          description: The updated Subscription object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSubscription"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteSubscriptionById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - subscriptions
      summary: Delete a Subscription
      description: Delete subscription.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Subscription ID
      responses:
        "200":
          description: The deleted Subscription object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSubscription"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/projects/{projectId}/subscriptions:
    get:
      operationId: getSubscriptionByProjectId
      tags:
        - subscriptions
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List Project Subscriptions
      description: Get the subscriptions associated with the project.
      deprecated: true
      responses:
        "200":
          description: List of Subscription objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSubscription"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: Project Id
  /lib/database-connections:
    post:
      operationId: createDatabaseConnectionConfig
      tags:
        - databaseConnections
      x-speakeasy-group: databaseConnections
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create Database Connection
      description: Create a new Database Connection.
      responses:
        "200":
          description: The created DatabaseConnectionConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DatabaseConnectionConfig object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatabaseConnectionConfig"
            examples:
              DatabaseConnectionExamplesMySQLWithConnectionString:
                $ref: "#/components/examples/DatabaseConnectionExamplesMySQLWithConnectionStrin\
                  g"
              DatabaseConnectionExamplesMySQLWithSecret:
                $ref: "#/components/examples/DatabaseConnectionExamplesMySQLWithSecret"
              DatabaseConnectionExamplesPostgreSQLWithConnectionString:
                $ref: "#/components/examples/DatabaseConnectionExamplesPostgreSQLWithConnection\
                  String"
              DatabaseConnectionExamplesPostgreSQLWithSecret:
                $ref: "#/components/examples/DatabaseConnectionExamplesPostgreSQLWithSecret"
              DatabaseConnectionExamplesSQLServerWithConnectionString:
                $ref: "#/components/examples/DatabaseConnectionExamplesSQLServerWithConnectionS\
                  tring"
              DatabaseConnectionExamplesSQLServerWithSecret:
                $ref: "#/components/examples/DatabaseConnectionExamplesSQLServerWithSecret"
              DatabaseConnectionExamplesSQLServerWithConfigObject:
                $ref: "#/components/examples/DatabaseConnectionExamplesSQLServerWithConfigObjec\
                  t"
              DatabaseConnectionExamplesOracleWithConnectionString:
                $ref: "#/components/examples/DatabaseConnectionExamplesOracleWithConnectionStri\
                  ng"
              DatabaseConnectionExamplesOracleWithSecret:
                $ref: "#/components/examples/DatabaseConnectionExamplesOracleWithSecret"
              DatabaseConnectionExamplesOracleWithCredentialsSecrets:
                $ref: "#/components/examples/DatabaseConnectionExamplesOracleWithCredentialsSec\
                  rets"
    get:
      operationId: getDatabaseConnectionConfig
      tags:
        - databaseConnections
      x-speakeasy-group: databaseConnections
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List Database Connections
      description: Get a list of all Database Connections.
      responses:
        "200":
          description: List of DatabaseConnectionConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: databaseType
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/DatabaseConnectionType"
          description: Type of Database Connections to include in the results.
  /lib/database-connections/{id}:
    delete:
      operationId: deleteDatabaseConnectionConfigById
      tags:
        - databaseConnections
      x-speakeasy-group: databaseConnections
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Database Connection
      description: Delete the specified Database Connection.
      responses:
        "200":
          description: The deleted DatabaseConnectionConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Database Connection to delete.
    get:
      operationId: getDatabaseConnectionConfigById
      tags:
        - databaseConnections
      x-speakeasy-group: databaseConnections
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Database Connection
      description: Get the specified Database Connection.
      responses:
        "200":
          description: List of DatabaseConnectionConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Database Connection not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Database Connection to get.
    patch:
      operationId: updateDatabaseConnectionConfigById
      tags:
        - databaseConnections
      x-speakeasy-group: databaseConnections
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Database Connection
      description: Update the specified Database Connection.<br/><br/>Provide a
        complete representation of the Database Connection that you want to
        update in the request body. This endpoint does not support partial
        updates. Cribl removes any omitted fields when updating the Database
        Connection.<br/><br/>Confirm that the configuration in your request body
        is correct before sending the request. If the configuration is
        incorrect, the updated Database Connection might not function as
        expected.
      responses:
        "200":
          description: The updated DatabaseConnectionConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DatabaseConnectionConfig object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatabaseConnectionConfig"
            examples:
              UpdateDatabaseConnectionExamplesMySQLWithConnectionString:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesMySQLWithConnectio\
                  nString"
              UpdateDatabaseConnectionExamplesMySQLWithSecret:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesMySQLWithSecret"
              UpdateDatabaseConnectionExamplesPostgreSQLWithConnectionString:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesPostgreSQLWithConn\
                  ectionString"
              UpdateDatabaseConnectionExamplesPostgreSQLWithSecret:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesPostgreSQLWithSecr\
                  et"
              UpdateDatabaseConnectionExamplesSQLServerWithConnectionString:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesSQLServerWithConne\
                  ctionString"
              UpdateDatabaseConnectionExamplesSQLServerWithSecret:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesSQLServerWithSecre\
                  t"
              UpdateDatabaseConnectionExamplesSQLServerWithConfigObject:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesSQLServerWithConfi\
                  gObject"
              UpdateDatabaseConnectionExamplesOracleWithConnectionString:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesOracleWithConnecti\
                  onString"
              UpdateDatabaseConnectionExamplesOracleWithSecret:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesOracleWithSecret"
              UpdateDatabaseConnectionExamplesOracleWithCredentialsSecrets:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesOracleWithCredenti\
                  alsSecrets"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Database Connection to update.
  /lib/database-connections/test:
    post:
      operationId: createLibDatabaseConnectionsTest
      tags:
        - databaseConnections
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Test a database connection
      description: Test a database connection using a connection string, a config
        object, or secrets.
      responses:
        "200":
          description: The created DatabaseConnectionTestResult object in a single-item
            list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionTestResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DatabaseConnectionTest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatabaseConnectionTest"
            examples:
              DatabaseConnectionTestExamplesMySQLConnectionString:
                $ref: "#/components/examples/DatabaseConnectionTestExamplesMySQLConnectionStrin\
                  g"
              DatabaseConnectionTestExamplesPostgresSecret:
                $ref: "#/components/examples/DatabaseConnectionTestExamplesPostgresSecret"
              DatabaseConnectionTestExamplesSQLServerConfigObj:
                $ref: "#/components/examples/DatabaseConnectionTestExamplesSQLServerConfigObj"
              DatabaseConnectionTestExamplesOracleCredentials:
                $ref: "#/components/examples/DatabaseConnectionTestExamplesOracleCredentials"
  /p/{pack}/lib/database-connections:
    post:
      operationId: createDatabaseConnectionConfigLibDatabaseConnectionsByPack
      tags:
        - databaseConnections
      x-speakeasy-group: packs.databaseConnections
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create Database Connection within a Pack
      description: Create a new Database Connection within the specified Pack.
      responses:
        "200":
          description: The created DatabaseConnectionConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DatabaseConnectionConfig object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatabaseConnectionConfig"
            examples:
              DatabaseConnectionExamplesMySQLWithConnectionString:
                $ref: "#/components/examples/DatabaseConnectionExamplesMySQLWithConnectionStrin\
                  g"
              DatabaseConnectionExamplesMySQLWithSecret:
                $ref: "#/components/examples/DatabaseConnectionExamplesMySQLWithSecret"
              DatabaseConnectionExamplesPostgreSQLWithConnectionString:
                $ref: "#/components/examples/DatabaseConnectionExamplesPostgreSQLWithConnection\
                  String"
              DatabaseConnectionExamplesPostgreSQLWithSecret:
                $ref: "#/components/examples/DatabaseConnectionExamplesPostgreSQLWithSecret"
              DatabaseConnectionExamplesSQLServerWithConnectionString:
                $ref: "#/components/examples/DatabaseConnectionExamplesSQLServerWithConnectionS\
                  tring"
              DatabaseConnectionExamplesSQLServerWithSecret:
                $ref: "#/components/examples/DatabaseConnectionExamplesSQLServerWithSecret"
              DatabaseConnectionExamplesSQLServerWithConfigObject:
                $ref: "#/components/examples/DatabaseConnectionExamplesSQLServerWithConfigObjec\
                  t"
              DatabaseConnectionExamplesOracleWithConnectionString:
                $ref: "#/components/examples/DatabaseConnectionExamplesOracleWithConnectionStri\
                  ng"
              DatabaseConnectionExamplesOracleWithSecret:
                $ref: "#/components/examples/DatabaseConnectionExamplesOracleWithSecret"
              DatabaseConnectionExamplesOracleWithCredentialsSecrets:
                $ref: "#/components/examples/DatabaseConnectionExamplesOracleWithCredentialsSec\
                  rets"
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getDatabaseConnectionConfigLibDatabaseConnectionsByPack
      tags:
        - databaseConnections
      x-speakeasy-group: packs.databaseConnections
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List Database Connections within a Pack
      description: Get a list of all Database Connections within the specified Pack.
      responses:
        "200":
          description: List of DatabaseConnectionConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: databaseType
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/DatabaseConnectionType"
          description: Type of Database Connections to include in the results.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/lib/database-connections/{id}:
    delete:
      operationId: deleteDatabaseConnectionConfigLibDatabaseConnectionsByPackAndId
      tags:
        - databaseConnections
      x-speakeasy-group: packs.databaseConnections
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Database Connection within a Pack
      description: Delete the specified Database Connection within the specified Pack.
      responses:
        "200":
          description: The deleted DatabaseConnectionConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Database Connection to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getDatabaseConnectionConfigLibDatabaseConnectionsByPackAndId
      tags:
        - databaseConnections
      x-speakeasy-group: packs.databaseConnections
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Database Connection within a Pack
      description: Get the specified Database Connection within the specified Pack.
      responses:
        "200":
          description: List of DatabaseConnectionConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Database Connection not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Database Connection to get.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    patch:
      operationId: updateDatabaseConnectionConfigLibDatabaseConnectionsByPackAndId
      tags:
        - databaseConnections
      x-speakeasy-group: packs.databaseConnections
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Database Connection within a Pack
      description: Update the specified Database Connection.<br/><br/>Provide a
        complete representation of the Database Connection that you want to
        update in the request body. This endpoint does not support partial
        updates. Cribl removes any omitted fields when updating the Database
        Connection.<br/><br/>Confirm that the configuration in your request body
        is correct before sending the request. If the configuration is
        incorrect, the updated Database Connection might not function as
        expected within the specified Pack.
      responses:
        "200":
          description: The updated DatabaseConnectionConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatabaseConnectionConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DatabaseConnectionConfig object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatabaseConnectionConfig"
            examples:
              UpdateDatabaseConnectionExamplesMySQLWithConnectionString:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesMySQLWithConnectio\
                  nString"
              UpdateDatabaseConnectionExamplesMySQLWithSecret:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesMySQLWithSecret"
              UpdateDatabaseConnectionExamplesPostgreSQLWithConnectionString:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesPostgreSQLWithConn\
                  ectionString"
              UpdateDatabaseConnectionExamplesPostgreSQLWithSecret:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesPostgreSQLWithSecr\
                  et"
              UpdateDatabaseConnectionExamplesSQLServerWithConnectionString:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesSQLServerWithConne\
                  ctionString"
              UpdateDatabaseConnectionExamplesSQLServerWithSecret:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesSQLServerWithSecre\
                  t"
              UpdateDatabaseConnectionExamplesSQLServerWithConfigObject:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesSQLServerWithConfi\
                  gObject"
              UpdateDatabaseConnectionExamplesOracleWithConnectionString:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesOracleWithConnecti\
                  onString"
              UpdateDatabaseConnectionExamplesOracleWithSecret:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesOracleWithSecret"
              UpdateDatabaseConnectionExamplesOracleWithCredentialsSecrets:
                $ref: "#/components/examples/UpdateDatabaseConnectionExamplesOracleWithCredenti\
                  alsSecrets"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Database Connection to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /lib/breakers:
    get:
      operationId: listEventBreakerRuleset
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - eventBreakerRules
      summary: List all Event Breaker Rulesets
      description: Get a list of all Event Breaker Rulesets.
      responses:
        "200":
          description: List of Event Breaker Ruleset objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEventBreakerRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createEventBreakerRuleset
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - eventBreakerRules
      summary: Create an Event Breaker Ruleset
      description: Create a new Event Breaker Ruleset.
      requestBody:
        description: Event Breaker Ruleset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EventBreakerRuleset"
            examples:
              EventBreakerRuleExamplesRegexBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesRegexBreaker"
              EventBreakerRuleExamplesJsonBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesJsonBreaker"
              EventBreakerRuleExamplesCsvBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesCsvBreaker"
      responses:
        "200":
          description: The created Event Breaker Ruleset object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEventBreakerRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/breakers/{id}:
    get:
      operationId: getEventBreakerRulesetById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - eventBreakerRules
      summary: Get Event Breaker Ruleset by ID
      description: Get Event Breaker Ruleset by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Event Breaker Ruleset objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEventBreakerRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateEventBreakerRulesetById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - eventBreakerRules
      summary: Update an Event Breaker Ruleset
      description: Update the specified Event Breaker Ruleset.<br/><br/>Provide a
        complete representation of the Event Breaker Ruleset that you want to
        update in the request body. This endpoint does not support partial
        updates. Cribl removes any omitted fields when updating the Event
        Breaker Ruleset.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated Event Breaker Ruleset might not function as
        expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Event Breaker Ruleset to update.
      requestBody:
        description: Event Breaker Ruleset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EventBreakerRuleset"
            examples:
              EventBreakerRuleExamplesRegexBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesRegexBreaker"
              EventBreakerRuleExamplesJsonBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesJsonBreaker"
              EventBreakerRuleExamplesCsvBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesCsvBreaker"
      responses:
        "200":
          description: The updated Event Breaker Ruleset object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEventBreakerRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteEventBreakerRulesetById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - eventBreakerRules
      summary: Delete Event Breaker Ruleset
      description: Delete Event Breaker Ruleset.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted Event Breaker Ruleset object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEventBreakerRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/breakers/{id}/move:
    put:
      operationId: updateEventBreakerRulesetMoveById
      tags:
        - eventBreakerRules
      x-speakeasy-name-override: move
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Move an Event Breaker Ruleset
      description: Move the specified Event Breaker Ruleset from the global context
        into a Pack.<br/><br/>To move a Ruleset from one Pack to another or from
        a Pack to the global context, use <code>PUT
        /p/{pack}/lib/breakers/{id}/move</code>.
      responses:
        "200":
          description: Moved Event Breaker Ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEventBreakerRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ContextMoveRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ContextMoveRequestBody"
            examples:
              MoveEventBreakerRulesetContextExamplesIntoPack:
                $ref: "#/components/examples/MoveEventBreakerRulesetContextExamplesIntoPack"
              MoveEventBreakerRulesetContextExamplesToGlobal:
                $ref: "#/components/examples/MoveEventBreakerRulesetContextExamplesToGlobal"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Event Breaker Ruleset to move.
  /p/{pack}/lib/breakers:
    post:
      operationId: createEventBreakerRulesetLibBreakersByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - eventBreakerRules
      summary: Create an Event Breaker Ruleset within a Pack
      description: Create a new Event Breaker Ruleset within the specified Pack.
      requestBody:
        description: Event Breaker Ruleset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EventBreakerRuleset"
            examples:
              EventBreakerRuleExamplesRegexBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesRegexBreaker"
              EventBreakerRuleExamplesJsonBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesJsonBreaker"
              EventBreakerRuleExamplesCsvBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesCsvBreaker"
      responses:
        "200":
          description: The created Event Breaker Ruleset object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEventBreakerRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.eventBreakerRules
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getEventBreakerRulesetLibBreakersByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - eventBreakerRules
      summary: List all Event Breaker Rulesets within a Pack
      description: Get a list of all Event Breaker Rulesets within the specified Pack.
      responses:
        "200":
          description: List of Event Breaker Ruleset objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEventBreakerRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.eventBreakerRules
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/lib/breakers/{id}/move:
    put:
      operationId: updateEventBreakerRulesetLibBreakersMoveByPackAndId
      tags:
        - eventBreakerRules
      x-speakeasy-name-override: move
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Move an Event Breaker Ruleset from a Pack
      description: Move the specified Event Breaker Ruleset from the given Pack to
        another Pack or to the global context.<br/><br/>To move the Ruleset
        between different Packs or back to the global context, use <code>PUT
        /lib/breakers/{id}/move</code>.
      responses:
        "200":
          description: Moved Event Breaker Ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEventBreakerRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ContextMoveRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ContextMoveRequestBody"
            examples:
              MoveEventBreakerRulesetContextExamplesIntoPack:
                $ref: "#/components/examples/MoveEventBreakerRulesetContextExamplesIntoPack"
              MoveEventBreakerRulesetContextExamplesToGlobal:
                $ref: "#/components/examples/MoveEventBreakerRulesetContextExamplesToGlobal"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Event Breaker Ruleset to move.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-group: packs.eventBreakerRules
  /p/{pack}/lib/breakers/{id}:
    patch:
      operationId: updateEventBreakerRulesetLibBreakersByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - eventBreakerRules
      summary: Update an Event Breaker Ruleset within a Pack
      description: Update the specified Event Breaker Ruleset.<br/><br/>Provide a
        complete representation of the Event Breaker Ruleset that you want to
        update in the request body. This endpoint does not support partial
        updates. Cribl removes any omitted fields when updating the Event
        Breaker Ruleset.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated Event Breaker Ruleset might not function as
        expected within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Event Breaker Ruleset to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: Event Breaker Ruleset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/EventBreakerRuleset"
            examples:
              EventBreakerRuleExamplesRegexBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesRegexBreaker"
              EventBreakerRuleExamplesJsonBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesJsonBreaker"
              EventBreakerRuleExamplesCsvBreaker:
                $ref: "#/components/examples/EventBreakerRuleExamplesCsvBreaker"
      responses:
        "200":
          description: The updated Event Breaker Ruleset object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEventBreakerRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.eventBreakerRules
  /functions/{id}:
    get:
      operationId: getFunctionsById
      tags:
        - functions
      x-speakeasy-group: functions
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Function
      description: Get the specified Function.
      responses:
        "200":
          description: a list of Function objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedFunctionResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Function to get.
  /functions:
    get:
      operationId: getFunctions
      tags:
        - functions
      x-speakeasy-group: functions
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Functions
      description: Get a list of all Functions.
      responses:
        "200":
          description: a list of Function objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedFunctionResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/functions/{id}:
    get:
      operationId: getFunctionsByPackAndId
      tags:
        - functions
      x-speakeasy-group: packs.functions
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Function within a Pack
      description: Get the specified Function within the specified Pack.
      responses:
        "200":
          description: a list of Function objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedFunctionResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Function to get.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/functions:
    get:
      operationId: getFunctionsByPack
      tags:
        - functions
      x-speakeasy-group: packs.functions
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Functions within a Pack
      description: Get a list of all Functions within the specified Pack.
      responses:
        "200":
          description: a list of Function objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedFunctionResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /collectors:
    get:
      operationId: getCollectors
      tags:
        - collectors
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all available Collectors
      description: Get a list of all available Collectors, representing the potential
        schemas for configuration. This endpoint does not retrieve all
        Collectors that are currently configured.
      responses:
        "200":
          description: List of Collector objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCollector"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: scope
          in: query
          required: false
          schema:
            type: string
            enum:
              - pack
            x-speakeasy-unknown-values: allow
          description: Pass "scope=pack" to include only Pack-enabled Collectors.
  /p/{pack}/collectors:
    get:
      operationId: getCollectorsByPack
      tags:
        - collectors
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all available Collectors within a Pack
      description: Get a list of all available Collectors, representing the potential
        schemas for configuration. This endpoint does not retrieve all
        Collectors that are currently configured within the specified Pack.
      responses:
        "200":
          description: List of Collector objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCollector"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: scope
          in: query
          required: false
          schema:
            type: string
            enum:
              - pack
            x-speakeasy-unknown-values: allow
          description: Pass "scope=pack" to include only Pack-enabled Collectors.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-group: packs.collectors
  /executors:
    get:
      operationId: listExecutor
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - executors
      summary: Get a list of Executor objects
      description: Get a list of Executor objects.
      responses:
        "200":
          description: List of Executor objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedExecutor"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /executors/{id}:
    get:
      operationId: getExecutorById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - executors
      summary: Get Executor by ID
      description: Get Executor by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Executor objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedExecutor"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/executors:
    get:
      operationId: getExecutorByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - executors
      summary: Get a list of Executor objects within a Pack
      description: Get a list of Executor objects within the specified Pack.
      responses:
        "200":
          description: List of Executor objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedExecutor"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.executors
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/executors/{id}:
    get:
      operationId: getExecutorByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - executors
      summary: Get Executor by ID within a Pack
      description: Get Executor by ID within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: List of Executor objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedExecutor"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.executors
  /lib/vars:
    get:
      operationId: listGlobalVariable
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - globalVariables
      summary: List all Global Variables
      description: List all GlobalVars with references.
      responses:
        "200":
          description: List of Global Variable objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalVar"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: with
          in: query
          required: false
          schema:
            type: string
          description: Pass "refs" to include references to fields the variable is used in
    post:
      operationId: createGlobalVariable
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - globalVariables
      summary: Create a Global Variable
      description: Create a new Global Variable.
      requestBody:
        description: Global Variable object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GlobalVar"
            examples:
              GlobalVarExamplesStringVariable:
                $ref: "#/components/examples/GlobalVarExamplesStringVariable"
              GlobalVarExamplesNumberVariable:
                $ref: "#/components/examples/GlobalVarExamplesNumberVariable"
              GlobalVarExamplesExpressionVariable:
                $ref: "#/components/examples/GlobalVarExamplesExpressionVariable"
      responses:
        "200":
          description: The created Global Variable object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalVar"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/vars/{id}:
    get:
      operationId: getGlobalVariableById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - globalVariables
      summary: Get Global Variable by ID
      description: Get Global Variable by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Global Variable objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalVar"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateGlobalVariableById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - globalVariables
      summary: Update a Global Variable
      description: Update the specified Global Variable.<br/><br/>Provide a complete
        representation of the Global Variable that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Global
        Variable.<br/><br/>Confirm that the configuration in your request body
        is correct before sending the request. If the configuration is
        incorrect, the updated Global Variable might not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Global Variable to update.
      requestBody:
        description: Global Variable object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GlobalVar"
            examples:
              GlobalVarExamplesStringVariable:
                $ref: "#/components/examples/GlobalVarExamplesStringVariable"
              GlobalVarExamplesNumberVariable:
                $ref: "#/components/examples/GlobalVarExamplesNumberVariable"
              GlobalVarExamplesExpressionVariable:
                $ref: "#/components/examples/GlobalVarExamplesExpressionVariable"
      responses:
        "200":
          description: The updated Global Variable object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalVar"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteGlobalVariableById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - globalVariables
      summary: Delete a Global Variable
      description: Delete the specified Global Variable.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Global Variable to delete.
      responses:
        "200":
          description: The deleted Global Variable object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalVar"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/lib/vars:
    get:
      operationId: getGlobalVariableLibVarsByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - globalVariables
      summary: List all Global Variables within a Pack
      description: List all GlobalVars with references within the specified Pack.
      responses:
        "200":
          description: List of Global Variable objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalVar"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: with
          in: query
          required: false
          schema:
            type: string
          description: Pass "refs" to include references to fields the variable is used in
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-group: packs.globalVariables
    post:
      operationId: createGlobalVariableLibVarsByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - globalVariables
      summary: Create a Global Variable within a Pack
      description: Create a new Global Variable within the specified Pack.
      requestBody:
        description: Global Variable object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GlobalVar"
            examples:
              GlobalVarExamplesStringVariable:
                $ref: "#/components/examples/GlobalVarExamplesStringVariable"
              GlobalVarExamplesNumberVariable:
                $ref: "#/components/examples/GlobalVarExamplesNumberVariable"
              GlobalVarExamplesExpressionVariable:
                $ref: "#/components/examples/GlobalVarExamplesExpressionVariable"
      responses:
        "200":
          description: The created Global Variable object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalVar"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.globalVariables
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/lib/vars/{id}:
    get:
      operationId: getGlobalVariableLibVarsByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - globalVariables
      summary: Get Global Variable by ID within a Pack
      description: Get Global Variable by ID within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: List of Global Variable objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalVar"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.globalVariables
    patch:
      operationId: updateGlobalVariableLibVarsByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - globalVariables
      summary: Update a Global Variable within a Pack
      description: Update the specified Global Variable.<br/><br/>Provide a complete
        representation of the Global Variable that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Global
        Variable.<br/><br/>Confirm that the configuration in your request body
        is correct before sending the request. If the configuration is
        incorrect, the updated Global Variable might not function as expected
        within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Global Variable to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: Global Variable object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GlobalVar"
            examples:
              GlobalVarExamplesStringVariable:
                $ref: "#/components/examples/GlobalVarExamplesStringVariable"
              GlobalVarExamplesNumberVariable:
                $ref: "#/components/examples/GlobalVarExamplesNumberVariable"
              GlobalVarExamplesExpressionVariable:
                $ref: "#/components/examples/GlobalVarExamplesExpressionVariable"
      responses:
        "200":
          description: The updated Global Variable object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalVar"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.globalVariables
    delete:
      operationId: deleteGlobalVariableLibVarsByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - globalVariables
      summary: Delete a Global Variable within a Pack
      description: Delete the specified Global Variable within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Global Variable to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: The deleted Global Variable object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalVar"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.globalVariables
  /lib/hmac-functions:
    get:
      operationId: listHmacFunction
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - hmacFunctions
      summary: List all HMAC Functions
      description: Get a list of all hash-based message authentication code (HMAC)
        Functions.
      responses:
        "200":
          description: List of HmacFunction objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedHmacFunction"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createHmacFunction
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - hmacFunctions
      summary: Create an HMAC Function
      description: Create a new hash-based message authentication code (HMAC) Function.
      requestBody:
        description: HmacFunction object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/HmacFunction"
            examples:
              HmacFunctionExamplesSHA256Webhook:
                $ref: "#/components/examples/HmacFunctionExamplesSHA256Webhook"
              HmacFunctionExamplesSHA1Legacy:
                $ref: "#/components/examples/HmacFunctionExamplesSHA1Legacy"
      responses:
        "200":
          description: The created HmacFunction object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedHmacFunction"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/hmac-functions/{id}:
    get:
      operationId: getHmacFunctionById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - hmacFunctions
      summary: Get HmacFunction by ID
      description: Get HmacFunction by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of HmacFunction objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedHmacFunction"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateHmacFunctionById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - hmacFunctions
      summary: Update an HMAC Function
      description: Update the specified hash-based message authentication code (HMAC)
        Function.<br/><br/>Provide a complete representation of the HMAC
        Function that you want to update in the request body. This endpoint does
        not support partial updates. Cribl removes any omitted fields when
        updating the HMAC Function.<br/><br/>Confirm that the configuration in
        your request body is correct before sending the request. If the
        configuration is incorrect, the updated HMAC Function might not function
        as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the HMAC Function to update.
      requestBody:
        description: HmacFunction object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/HmacFunction"
            examples:
              HmacFunctionExamplesSHA256Webhook:
                $ref: "#/components/examples/HmacFunctionExamplesSHA256Webhook"
              HmacFunctionExamplesSHA1Legacy:
                $ref: "#/components/examples/HmacFunctionExamplesSHA1Legacy"
      responses:
        "200":
          description: The updated HmacFunction object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedHmacFunction"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteHmacFunctionById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - hmacFunctions
      summary: Delete HmacFunction
      description: Delete HmacFunction.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted HmacFunction object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedHmacFunction"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/lib/hmac-functions:
    post:
      operationId: createHmacFunctionLibByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - hmacFunctions
      summary: Create an HMAC Function within a Pack
      description: Create a new hash-based message authentication code (HMAC) Function
        within the specified Pack.
      requestBody:
        description: HmacFunction object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/HmacFunction"
            examples:
              HmacFunctionExamplesSHA256Webhook:
                $ref: "#/components/examples/HmacFunctionExamplesSHA256Webhook"
              HmacFunctionExamplesSHA1Legacy:
                $ref: "#/components/examples/HmacFunctionExamplesSHA1Legacy"
      responses:
        "200":
          description: The created HmacFunction object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedHmacFunction"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.hmacFunctions
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getHmacFunctionLibByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - hmacFunctions
      summary: List all HMAC Functions within a Pack
      description: Get a list of all hash-based message authentication code (HMAC)
        Functions within the specified Pack.
      responses:
        "200":
          description: List of HmacFunction objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedHmacFunction"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.hmacFunctions
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/lib/hmac-functions/{id}:
    patch:
      operationId: updateHmacFunctionLibByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - hmacFunctions
      summary: Update an HMAC Function within a Pack
      description: Update the specified hash-based message authentication code (HMAC)
        Function.<br/><br/>Provide a complete representation of the HMAC
        Function that you want to update in the request body. This endpoint does
        not support partial updates. Cribl removes any omitted fields when
        updating the HMAC Function.<br/><br/>Confirm that the configuration in
        your request body is correct before sending the request. If the
        configuration is incorrect, the updated HMAC Function might not function
        as expected within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the HMAC Function to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: HmacFunction object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/HmacFunction"
            examples:
              HmacFunctionExamplesSHA256Webhook:
                $ref: "#/components/examples/HmacFunctionExamplesSHA256Webhook"
              HmacFunctionExamplesSHA1Legacy:
                $ref: "#/components/examples/HmacFunctionExamplesSHA1Legacy"
      responses:
        "200":
          description: The updated HmacFunction object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedHmacFunction"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.hmacFunctions
  /system/inputs:
    get:
      operationId: listInput
      x-speakeasy-group: sources
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - sources
      summary: List all Sources
      description: Get a list of all Sources.
      responses:
        "200":
          description: a list of Source objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/SourceType"
          description: Type of Source to include in the results. Each request can include
            only one <code>type</code> parameter; multiple parameters per
            request are not supported.
    post:
      operationId: createInput
      x-speakeasy-group: sources
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - sources
      summary: Create a Source
      description: Create a new Source. The system-managed provenance field (JSON
        <code>criblSourceProvenance</code>) must be omitted from the request
        body.
      requestBody:
        description: Input object.
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: "#/components/schemas/Input"
                - type: object
                  required:
                    - id
            examples:
              InputCreateExamplesAnthropicCompliance:
                $ref: "#/components/examples/InputCreateExamplesAnthropicCompliance"
              InputCreateExamplesAppleUnifiedLogs:
                $ref: "#/components/examples/InputCreateExamplesAppleUnifiedLogs"
              InputCreateExamplesAppscope:
                $ref: "#/components/examples/InputCreateExamplesAppscope"
              InputCreateExamplesAzureBlob:
                $ref: "#/components/examples/InputCreateExamplesAzureBlob"
              InputCreateExamplesCloudflareHec:
                $ref: "#/components/examples/InputCreateExamplesCloudflareHec"
              InputCreateExamplesConfluentCloud:
                $ref: "#/components/examples/InputCreateExamplesConfluentCloud"
              InputCreateExamplesCollection:
                $ref: "#/components/examples/InputCreateExamplesCollection"
              InputCreateExamplesCriblHttp:
                $ref: "#/components/examples/InputCreateExamplesCriblHttp"
              InputCreateExamplesCriblLakeHttp:
                $ref: "#/components/examples/InputCreateExamplesCriblLakeHttp"
              InputCreateExamplesCriblTcp:
                $ref: "#/components/examples/InputCreateExamplesCriblTcp"
              InputCreateExamplesCrowdstrike:
                $ref: "#/components/examples/InputCreateExamplesCrowdstrike"
              InputCreateExamplesDatadogAgent:
                $ref: "#/components/examples/InputCreateExamplesDatadogAgent"
              InputCreateExamplesDatagen:
                $ref: "#/components/examples/InputCreateExamplesDatagen"
              InputCreateExamplesEdgePrometheus:
                $ref: "#/components/examples/InputCreateExamplesEdgePrometheus"
              InputCreateExamplesElastic:
                $ref: "#/components/examples/InputCreateExamplesElastic"
              InputCreateExamplesEventhub:
                $ref: "#/components/examples/InputCreateExamplesEventhub"
              InputCreateExamplesEventhubAmqp:
                $ref: "#/components/examples/InputCreateExamplesEventhubAmqp"
              InputCreateExamplesExec:
                $ref: "#/components/examples/InputCreateExamplesExec"
              InputCreateExamplesFile:
                $ref: "#/components/examples/InputCreateExamplesFile"
              InputCreateExamplesFirehose:
                $ref: "#/components/examples/InputCreateExamplesFirehose"
              InputCreateExamplesGrafana:
                $ref: "#/components/examples/InputCreateExamplesGrafana"
              InputCreateExamplesGooglePubsub:
                $ref: "#/components/examples/InputCreateExamplesGooglePubsub"
              InputCreateExamplesHttp:
                $ref: "#/components/examples/InputCreateExamplesHttp"
              InputCreateExamplesHttpRaw:
                $ref: "#/components/examples/InputCreateExamplesHttpRaw"
              InputCreateExamplesJournalFiles:
                $ref: "#/components/examples/InputCreateExamplesJournalFiles"
              InputCreateExamplesKafka:
                $ref: "#/components/examples/InputCreateExamplesKafka"
              InputCreateExamplesKinesis:
                $ref: "#/components/examples/InputCreateExamplesKinesis"
              InputCreateExamplesKubeEvents:
                $ref: "#/components/examples/InputCreateExamplesKubeEvents"
              InputCreateExamplesKubeLogs:
                $ref: "#/components/examples/InputCreateExamplesKubeLogs"
              InputCreateExamplesKubeMetrics:
                $ref: "#/components/examples/InputCreateExamplesKubeMetrics"
              InputCreateExamplesLoki:
                $ref: "#/components/examples/InputCreateExamplesLoki"
              InputCreateExamplesMetrics:
                $ref: "#/components/examples/InputCreateExamplesMetrics"
              InputCreateExamplesModelDrivenTelemetry:
                $ref: "#/components/examples/InputCreateExamplesModelDrivenTelemetry"
              InputCreateExamplesMsk:
                $ref: "#/components/examples/InputCreateExamplesMsk"
              InputCreateExamplesNetflow:
                $ref: "#/components/examples/InputCreateExamplesNetflow"
              InputCreateExamplesOffice365Mgmt:
                $ref: "#/components/examples/InputCreateExamplesOffice365Mgmt"
              InputCreateExamplesMicrosoftGraph:
                $ref: "#/components/examples/InputCreateExamplesMicrosoftGraph"
              InputCreateExamplesOffice365MsgTrace:
                $ref: "#/components/examples/InputCreateExamplesOffice365MsgTrace"
              InputCreateExamplesOffice365Service:
                $ref: "#/components/examples/InputCreateExamplesOffice365Service"
              InputCreateExamplesOkta:
                $ref: "#/components/examples/InputCreateExamplesOkta"
              InputCreateExamplesOpenAI:
                $ref: "#/components/examples/InputCreateExamplesOpenAI"
              InputCreateExamplesOpenAIComplianceLogs:
                $ref: "#/components/examples/InputCreateExamplesOpenAIComplianceLogs"
              InputCreateExamplesOpenTelemetry:
                $ref: "#/components/examples/InputCreateExamplesOpenTelemetry"
              InputCreateExamplesPrometheus:
                $ref: "#/components/examples/InputCreateExamplesPrometheus"
              InputCreateExamplesPrometheusRw:
                $ref: "#/components/examples/InputCreateExamplesPrometheusRw"
              InputCreateExamplesRawUdp:
                $ref: "#/components/examples/InputCreateExamplesRawUdp"
              InputCreateExamplesS3:
                $ref: "#/components/examples/InputCreateExamplesS3"
              InputCreateExamplesS3Inventory:
                $ref: "#/components/examples/InputCreateExamplesS3Inventory"
              InputCreateExamplesSecurityLake:
                $ref: "#/components/examples/InputCreateExamplesSecurityLake"
              InputCreateExamplesServiceNowTable:
                $ref: "#/components/examples/InputCreateExamplesServiceNowTable"
              InputCreateExamplesSnmp:
                $ref: "#/components/examples/InputCreateExamplesSnmp"
              InputCreateExamplesSplunk:
                $ref: "#/components/examples/InputCreateExamplesSplunk"
              InputCreateExamplesSplunkHec:
                $ref: "#/components/examples/InputCreateExamplesSplunkHec"
              InputCreateExamplesSplunkSearch:
                $ref: "#/components/examples/InputCreateExamplesSplunkSearch"
              InputCreateExamplesSqs:
                $ref: "#/components/examples/InputCreateExamplesSqs"
              InputCreateExamplesSyslog:
                $ref: "#/components/examples/InputCreateExamplesSyslog"
              InputCreateExamplesSystemMetrics:
                $ref: "#/components/examples/InputCreateExamplesSystemMetrics"
              InputCreateExamplesSystemState:
                $ref: "#/components/examples/InputCreateExamplesSystemState"
              InputCreateExamplesTcp:
                $ref: "#/components/examples/InputCreateExamplesTcp"
              InputCreateExamplesTcpjson:
                $ref: "#/components/examples/InputCreateExamplesTcpjson"
              InputCreateExamplesWef:
                $ref: "#/components/examples/InputCreateExamplesWef"
              InputCreateExamplesWinEventLogs:
                $ref: "#/components/examples/InputCreateExamplesWinEventLogs"
              InputCreateExamplesWindowsMetrics:
                $ref: "#/components/examples/InputCreateExamplesWindowsMetrics"
              InputCreateExamplesWiz:
                $ref: "#/components/examples/InputCreateExamplesWiz"
              InputCreateExamplesWizWebhook:
                $ref: "#/components/examples/InputCreateExamplesWizWebhook"
              InputCreateExamplesZscalerHec:
                $ref: "#/components/examples/InputCreateExamplesZscalerHec"
      responses:
        "200":
          description: the created Source object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/inputs/{id}:
    get:
      operationId: getInputById
      x-speakeasy-group: sources
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - sources
      summary: Get a Source
      description: Get the specified Source.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to get.
      responses:
        "200":
          description: a Source object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateInputById
      x-speakeasy-group: sources
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - sources
      summary: Update a Source
      description: Update the specified Source.<br/><br/>Provide a complete
        representation of the Source that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Source.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Source might not
        function as expected.<br/><br/>Cribl preserves
        <code>criblSourceProvenance</code> when you omit it from the request
        body, and you cannot overwrite it through this endpoint.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to update.
      requestBody:
        description: Input object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Input"
            examples:
              UpdateInputExamplesAnthropicCompliance:
                $ref: "#/components/examples/UpdateInputExamplesAnthropicCompliance"
              UpdateInputExamplesAppleUnifiedLogs:
                $ref: "#/components/examples/UpdateInputExamplesAppleUnifiedLogs"
              UpdateInputExamplesAppscope:
                $ref: "#/components/examples/UpdateInputExamplesAppscope"
              UpdateInputExamplesAzureBlob:
                $ref: "#/components/examples/UpdateInputExamplesAzureBlob"
              UpdateInputExamplesCloudflareHec:
                $ref: "#/components/examples/UpdateInputExamplesCloudflareHec"
              UpdateInputExamplesConfluentCloud:
                $ref: "#/components/examples/UpdateInputExamplesConfluentCloud"
              UpdateInputExamplesCollection:
                $ref: "#/components/examples/UpdateInputExamplesCollection"
              UpdateInputExamplesCribl:
                $ref: "#/components/examples/UpdateInputExamplesCribl"
              UpdateInputExamplesCriblHttp:
                $ref: "#/components/examples/UpdateInputExamplesCriblHttp"
              UpdateInputExamplesCriblLakeHttp:
                $ref: "#/components/examples/UpdateInputExamplesCriblLakeHttp"
              UpdateInputExamplesCriblMetrics:
                $ref: "#/components/examples/UpdateInputExamplesCriblMetrics"
              UpdateInputExamplesCriblTcp:
                $ref: "#/components/examples/UpdateInputExamplesCriblTcp"
              UpdateInputExamplesCrowdstrike:
                $ref: "#/components/examples/UpdateInputExamplesCrowdstrike"
              UpdateInputExamplesDatadogAgent:
                $ref: "#/components/examples/UpdateInputExamplesDatadogAgent"
              UpdateInputExamplesDatagen:
                $ref: "#/components/examples/UpdateInputExamplesDatagen"
              UpdateInputExamplesEdgePrometheus:
                $ref: "#/components/examples/UpdateInputExamplesEdgePrometheus"
              UpdateInputExamplesElastic:
                $ref: "#/components/examples/UpdateInputExamplesElastic"
              UpdateInputExamplesEventhub:
                $ref: "#/components/examples/UpdateInputExamplesEventhub"
              UpdateInputExamplesEventhubAmqp:
                $ref: "#/components/examples/UpdateInputExamplesEventhubAmqp"
              UpdateInputExamplesExec:
                $ref: "#/components/examples/UpdateInputExamplesExec"
              UpdateInputExamplesFile:
                $ref: "#/components/examples/UpdateInputExamplesFile"
              UpdateInputExamplesFirehose:
                $ref: "#/components/examples/UpdateInputExamplesFirehose"
              UpdateInputExamplesGrafana:
                $ref: "#/components/examples/UpdateInputExamplesGrafana"
              UpdateInputExamplesGooglePubsub:
                $ref: "#/components/examples/UpdateInputExamplesGooglePubsub"
              UpdateInputExamplesHttp:
                $ref: "#/components/examples/UpdateInputExamplesHttp"
              UpdateInputExamplesHttpRaw:
                $ref: "#/components/examples/UpdateInputExamplesHttpRaw"
              UpdateInputExamplesJournalFiles:
                $ref: "#/components/examples/UpdateInputExamplesJournalFiles"
              UpdateInputExamplesKafka:
                $ref: "#/components/examples/UpdateInputExamplesKafka"
              UpdateInputExamplesKinesis:
                $ref: "#/components/examples/UpdateInputExamplesKinesis"
              UpdateInputExamplesKubeEvents:
                $ref: "#/components/examples/UpdateInputExamplesKubeEvents"
              UpdateInputExamplesKubeLogs:
                $ref: "#/components/examples/UpdateInputExamplesKubeLogs"
              UpdateInputExamplesKubeMetrics:
                $ref: "#/components/examples/UpdateInputExamplesKubeMetrics"
              UpdateInputExamplesLoki:
                $ref: "#/components/examples/UpdateInputExamplesLoki"
              UpdateInputExamplesMetrics:
                $ref: "#/components/examples/UpdateInputExamplesMetrics"
              UpdateInputExamplesModelDrivenTelemetry:
                $ref: "#/components/examples/UpdateInputExamplesModelDrivenTelemetry"
              UpdateInputExamplesMsk:
                $ref: "#/components/examples/UpdateInputExamplesMsk"
              UpdateInputExamplesNetflow:
                $ref: "#/components/examples/UpdateInputExamplesNetflow"
              UpdateInputExamplesOffice365Mgmt:
                $ref: "#/components/examples/UpdateInputExamplesOffice365Mgmt"
              UpdateInputExamplesMicrosoftGraph:
                $ref: "#/components/examples/UpdateInputExamplesMicrosoftGraph"
              UpdateInputExamplesOffice365MsgTrace:
                $ref: "#/components/examples/UpdateInputExamplesOffice365MsgTrace"
              UpdateInputExamplesOffice365Service:
                $ref: "#/components/examples/UpdateInputExamplesOffice365Service"
              UpdateInputExamplesOkta:
                $ref: "#/components/examples/UpdateInputExamplesOkta"
              UpdateInputExamplesOpenAI:
                $ref: "#/components/examples/UpdateInputExamplesOpenAI"
              UpdateInputExamplesOpenAIComplianceLogs:
                $ref: "#/components/examples/UpdateInputExamplesOpenAIComplianceLogs"
              UpdateInputExamplesOpenTelemetry:
                $ref: "#/components/examples/UpdateInputExamplesOpenTelemetry"
              UpdateInputExamplesPrometheus:
                $ref: "#/components/examples/UpdateInputExamplesPrometheus"
              UpdateInputExamplesPrometheusRw:
                $ref: "#/components/examples/UpdateInputExamplesPrometheusRw"
              UpdateInputExamplesRawUdp:
                $ref: "#/components/examples/UpdateInputExamplesRawUdp"
              UpdateInputExamplesS3:
                $ref: "#/components/examples/UpdateInputExamplesS3"
              UpdateInputExamplesS3Inventory:
                $ref: "#/components/examples/UpdateInputExamplesS3Inventory"
              UpdateInputExamplesSecurityLake:
                $ref: "#/components/examples/UpdateInputExamplesSecurityLake"
              UpdateInputExamplesServiceNowTable:
                $ref: "#/components/examples/UpdateInputExamplesServiceNowTable"
              UpdateInputExamplesSnmp:
                $ref: "#/components/examples/UpdateInputExamplesSnmp"
              UpdateInputExamplesSplunk:
                $ref: "#/components/examples/UpdateInputExamplesSplunk"
              UpdateInputExamplesSplunkHec:
                $ref: "#/components/examples/UpdateInputExamplesSplunkHec"
              UpdateInputExamplesSplunkSearch:
                $ref: "#/components/examples/UpdateInputExamplesSplunkSearch"
              UpdateInputExamplesSqs:
                $ref: "#/components/examples/UpdateInputExamplesSqs"
              UpdateInputExamplesSyslog:
                $ref: "#/components/examples/UpdateInputExamplesSyslog"
              UpdateInputExamplesSystemMetrics:
                $ref: "#/components/examples/UpdateInputExamplesSystemMetrics"
              UpdateInputExamplesSystemState:
                $ref: "#/components/examples/UpdateInputExamplesSystemState"
              UpdateInputExamplesTcp:
                $ref: "#/components/examples/UpdateInputExamplesTcp"
              UpdateInputExamplesTcpjson:
                $ref: "#/components/examples/UpdateInputExamplesTcpjson"
              UpdateInputExamplesWef:
                $ref: "#/components/examples/UpdateInputExamplesWef"
              UpdateInputExamplesWinEventLogs:
                $ref: "#/components/examples/UpdateInputExamplesWinEventLogs"
              UpdateInputExamplesWindowsMetrics:
                $ref: "#/components/examples/UpdateInputExamplesWindowsMetrics"
              UpdateInputExamplesWiz:
                $ref: "#/components/examples/UpdateInputExamplesWiz"
              UpdateInputExamplesWizWebhook:
                $ref: "#/components/examples/UpdateInputExamplesWizWebhook"
              UpdateInputExamplesZscalerHec:
                $ref: "#/components/examples/UpdateInputExamplesZscalerHec"
      responses:
        "200":
          description: the updated Source object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteInputById
      x-speakeasy-group: sources
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - sources
      summary: Delete a Source
      description: Delete the specified Source.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to delete.
      responses:
        "200":
          description: the deleted Source object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/inputs/{id}/hectoken:
    post:
      operationId: createInputHecTokenById
      tags:
        - sources
      x-speakeasy-group: sources.hecTokens
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Add an HEC token and optional metadata to a Splunk HEC Source
      description: Add an HEC token and optional metadata to the specified Splunk HEC
        Source.
      responses:
        "200":
          description: the updated Splunk HEC Source with the new HEC token
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputSplunkHec"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AddHecTokenRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AddHecTokenRequest"
            examples:
              HecTokenExamplesHecToken:
                $ref: "#/components/examples/HecTokenExamplesHecToken"
              HecTokenExamplesHecTokenWithIndexAccess:
                $ref: "#/components/examples/HecTokenExamplesHecTokenWithIndexAccess"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Splunk HEC Source.
  /system/inputs/{id}/pq:
    delete:
      operationId: deleteInputPqById
      tags:
        - sources
      x-speakeasy-group: sources.pq
      x-speakeasy-name-override: clear
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Clear the persistent queue for a Source
      description: Clear the persistent queue (PQ) for the specified Source.
      responses:
        "201":
          description: A list of job ids for the background job that clears the persistent
            queue
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to clear the PQ for.
    get:
      operationId: getInputPqById
      tags:
        - sources
      x-speakeasy-group: sources.pq
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get information about the latest job to clear the persistent queue for
        a Source
      description: Get information about the latest job to clear the persistent queue
        (PQ) for the specified Source.
      responses:
        "200":
          description: information about the latest job to clear the PQ for the Source
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedJobInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to get PQ job information for.
  /system/inputs/{id}/hectoken/{token}:
    patch:
      operationId: updateInputHecTokenByIdAndToken
      tags:
        - sources
      x-speakeasy-group: sources.hecTokens
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update metadata for an HEC token for a Splunk HEC Source
      description: Update the metadata for the specified HEC token for the specified
        Splunk HEC Source.
      responses:
        "200":
          description: the updated HEC token
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputSplunkHec"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: UpdateHecTokenRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateHecTokenRequest"
            examples:
              HecTokenExamplesHecToken:
                $ref: "#/components/examples/HecTokenExamplesHecToken"
              HecTokenExamplesHecTokenWithIndexAccess:
                $ref: "#/components/examples/HecTokenExamplesHecTokenWithIndexAccess"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Splunk HEC Source.
        - name: token
          in: path
          required: true
          schema:
            type: string
          description: The HEC token value to update.
  /p/{pack}/system/inputs:
    get:
      operationId: getInputSystemByPack
      x-speakeasy-group: packs.sources
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - sources
      summary: List all Sources within a Pack
      description: Get a list of all Sources within the specified Pack.
      responses:
        "200":
          description: a list of Source objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/SourceType"
          description: Type of Source to include in the results. Each request can include
            only one <code>type</code> parameter; multiple parameters per
            request are not supported.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    post:
      operationId: createInputSystemByPack
      x-speakeasy-group: packs.sources
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - sources
      summary: Create a Source within a Pack
      description: Create a new Source. The system-managed provenance field (JSON
        <code>criblSourceProvenance</code>) must be omitted from the request
        body within the specified Pack.
      requestBody:
        description: Input object.
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: "#/components/schemas/Input"
                - type: object
                  required:
                    - id
            examples:
              InputCreateExamplesAnthropicCompliance:
                $ref: "#/components/examples/InputCreateExamplesAnthropicCompliance"
              InputCreateExamplesAppleUnifiedLogs:
                $ref: "#/components/examples/InputCreateExamplesAppleUnifiedLogs"
              InputCreateExamplesAppscope:
                $ref: "#/components/examples/InputCreateExamplesAppscope"
              InputCreateExamplesAzureBlob:
                $ref: "#/components/examples/InputCreateExamplesAzureBlob"
              InputCreateExamplesCloudflareHec:
                $ref: "#/components/examples/InputCreateExamplesCloudflareHec"
              InputCreateExamplesConfluentCloud:
                $ref: "#/components/examples/InputCreateExamplesConfluentCloud"
              InputCreateExamplesCollection:
                $ref: "#/components/examples/InputCreateExamplesCollection"
              InputCreateExamplesCriblHttp:
                $ref: "#/components/examples/InputCreateExamplesCriblHttp"
              InputCreateExamplesCriblLakeHttp:
                $ref: "#/components/examples/InputCreateExamplesCriblLakeHttp"
              InputCreateExamplesCriblTcp:
                $ref: "#/components/examples/InputCreateExamplesCriblTcp"
              InputCreateExamplesCrowdstrike:
                $ref: "#/components/examples/InputCreateExamplesCrowdstrike"
              InputCreateExamplesDatadogAgent:
                $ref: "#/components/examples/InputCreateExamplesDatadogAgent"
              InputCreateExamplesDatagen:
                $ref: "#/components/examples/InputCreateExamplesDatagen"
              InputCreateExamplesEdgePrometheus:
                $ref: "#/components/examples/InputCreateExamplesEdgePrometheus"
              InputCreateExamplesElastic:
                $ref: "#/components/examples/InputCreateExamplesElastic"
              InputCreateExamplesEventhub:
                $ref: "#/components/examples/InputCreateExamplesEventhub"
              InputCreateExamplesEventhubAmqp:
                $ref: "#/components/examples/InputCreateExamplesEventhubAmqp"
              InputCreateExamplesExec:
                $ref: "#/components/examples/InputCreateExamplesExec"
              InputCreateExamplesFile:
                $ref: "#/components/examples/InputCreateExamplesFile"
              InputCreateExamplesFirehose:
                $ref: "#/components/examples/InputCreateExamplesFirehose"
              InputCreateExamplesGrafana:
                $ref: "#/components/examples/InputCreateExamplesGrafana"
              InputCreateExamplesGooglePubsub:
                $ref: "#/components/examples/InputCreateExamplesGooglePubsub"
              InputCreateExamplesHttp:
                $ref: "#/components/examples/InputCreateExamplesHttp"
              InputCreateExamplesHttpRaw:
                $ref: "#/components/examples/InputCreateExamplesHttpRaw"
              InputCreateExamplesJournalFiles:
                $ref: "#/components/examples/InputCreateExamplesJournalFiles"
              InputCreateExamplesKafka:
                $ref: "#/components/examples/InputCreateExamplesKafka"
              InputCreateExamplesKinesis:
                $ref: "#/components/examples/InputCreateExamplesKinesis"
              InputCreateExamplesKubeEvents:
                $ref: "#/components/examples/InputCreateExamplesKubeEvents"
              InputCreateExamplesKubeLogs:
                $ref: "#/components/examples/InputCreateExamplesKubeLogs"
              InputCreateExamplesKubeMetrics:
                $ref: "#/components/examples/InputCreateExamplesKubeMetrics"
              InputCreateExamplesLoki:
                $ref: "#/components/examples/InputCreateExamplesLoki"
              InputCreateExamplesMetrics:
                $ref: "#/components/examples/InputCreateExamplesMetrics"
              InputCreateExamplesModelDrivenTelemetry:
                $ref: "#/components/examples/InputCreateExamplesModelDrivenTelemetry"
              InputCreateExamplesMsk:
                $ref: "#/components/examples/InputCreateExamplesMsk"
              InputCreateExamplesNetflow:
                $ref: "#/components/examples/InputCreateExamplesNetflow"
              InputCreateExamplesOffice365Mgmt:
                $ref: "#/components/examples/InputCreateExamplesOffice365Mgmt"
              InputCreateExamplesMicrosoftGraph:
                $ref: "#/components/examples/InputCreateExamplesMicrosoftGraph"
              InputCreateExamplesOffice365MsgTrace:
                $ref: "#/components/examples/InputCreateExamplesOffice365MsgTrace"
              InputCreateExamplesOffice365Service:
                $ref: "#/components/examples/InputCreateExamplesOffice365Service"
              InputCreateExamplesOkta:
                $ref: "#/components/examples/InputCreateExamplesOkta"
              InputCreateExamplesOpenAI:
                $ref: "#/components/examples/InputCreateExamplesOpenAI"
              InputCreateExamplesOpenAIComplianceLogs:
                $ref: "#/components/examples/InputCreateExamplesOpenAIComplianceLogs"
              InputCreateExamplesOpenTelemetry:
                $ref: "#/components/examples/InputCreateExamplesOpenTelemetry"
              InputCreateExamplesPrometheus:
                $ref: "#/components/examples/InputCreateExamplesPrometheus"
              InputCreateExamplesPrometheusRw:
                $ref: "#/components/examples/InputCreateExamplesPrometheusRw"
              InputCreateExamplesRawUdp:
                $ref: "#/components/examples/InputCreateExamplesRawUdp"
              InputCreateExamplesS3:
                $ref: "#/components/examples/InputCreateExamplesS3"
              InputCreateExamplesS3Inventory:
                $ref: "#/components/examples/InputCreateExamplesS3Inventory"
              InputCreateExamplesSecurityLake:
                $ref: "#/components/examples/InputCreateExamplesSecurityLake"
              InputCreateExamplesServiceNowTable:
                $ref: "#/components/examples/InputCreateExamplesServiceNowTable"
              InputCreateExamplesSnmp:
                $ref: "#/components/examples/InputCreateExamplesSnmp"
              InputCreateExamplesSplunk:
                $ref: "#/components/examples/InputCreateExamplesSplunk"
              InputCreateExamplesSplunkHec:
                $ref: "#/components/examples/InputCreateExamplesSplunkHec"
              InputCreateExamplesSplunkSearch:
                $ref: "#/components/examples/InputCreateExamplesSplunkSearch"
              InputCreateExamplesSqs:
                $ref: "#/components/examples/InputCreateExamplesSqs"
              InputCreateExamplesSyslog:
                $ref: "#/components/examples/InputCreateExamplesSyslog"
              InputCreateExamplesSystemMetrics:
                $ref: "#/components/examples/InputCreateExamplesSystemMetrics"
              InputCreateExamplesSystemState:
                $ref: "#/components/examples/InputCreateExamplesSystemState"
              InputCreateExamplesTcp:
                $ref: "#/components/examples/InputCreateExamplesTcp"
              InputCreateExamplesTcpjson:
                $ref: "#/components/examples/InputCreateExamplesTcpjson"
              InputCreateExamplesWef:
                $ref: "#/components/examples/InputCreateExamplesWef"
              InputCreateExamplesWinEventLogs:
                $ref: "#/components/examples/InputCreateExamplesWinEventLogs"
              InputCreateExamplesWindowsMetrics:
                $ref: "#/components/examples/InputCreateExamplesWindowsMetrics"
              InputCreateExamplesWiz:
                $ref: "#/components/examples/InputCreateExamplesWiz"
              InputCreateExamplesWizWebhook:
                $ref: "#/components/examples/InputCreateExamplesWizWebhook"
              InputCreateExamplesZscalerHec:
                $ref: "#/components/examples/InputCreateExamplesZscalerHec"
      responses:
        "200":
          description: the created Source object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/inputs/{id}:
    get:
      operationId: getInputSystemByPackAndId
      x-speakeasy-group: packs.sources
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - sources
      summary: Get a Source within a Pack
      description: Get the specified Source within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to get.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: a Source object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateInputSystemByPackAndId
      x-speakeasy-group: packs.sources
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - sources
      summary: Update a Source within a Pack
      description: Update the specified Source.<br/><br/>Provide a complete
        representation of the Source that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Source.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Source might not
        function as expected.<br/><br/>Cribl preserves
        <code>criblSourceProvenance</code> when you omit it from the request
        body, and you cannot overwrite it through this endpoint within the
        specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: Input object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Input"
            examples:
              UpdateInputExamplesAnthropicCompliance:
                $ref: "#/components/examples/UpdateInputExamplesAnthropicCompliance"
              UpdateInputExamplesAppleUnifiedLogs:
                $ref: "#/components/examples/UpdateInputExamplesAppleUnifiedLogs"
              UpdateInputExamplesAppscope:
                $ref: "#/components/examples/UpdateInputExamplesAppscope"
              UpdateInputExamplesAzureBlob:
                $ref: "#/components/examples/UpdateInputExamplesAzureBlob"
              UpdateInputExamplesCloudflareHec:
                $ref: "#/components/examples/UpdateInputExamplesCloudflareHec"
              UpdateInputExamplesConfluentCloud:
                $ref: "#/components/examples/UpdateInputExamplesConfluentCloud"
              UpdateInputExamplesCollection:
                $ref: "#/components/examples/UpdateInputExamplesCollection"
              UpdateInputExamplesCribl:
                $ref: "#/components/examples/UpdateInputExamplesCribl"
              UpdateInputExamplesCriblHttp:
                $ref: "#/components/examples/UpdateInputExamplesCriblHttp"
              UpdateInputExamplesCriblLakeHttp:
                $ref: "#/components/examples/UpdateInputExamplesCriblLakeHttp"
              UpdateInputExamplesCriblMetrics:
                $ref: "#/components/examples/UpdateInputExamplesCriblMetrics"
              UpdateInputExamplesCriblTcp:
                $ref: "#/components/examples/UpdateInputExamplesCriblTcp"
              UpdateInputExamplesCrowdstrike:
                $ref: "#/components/examples/UpdateInputExamplesCrowdstrike"
              UpdateInputExamplesDatadogAgent:
                $ref: "#/components/examples/UpdateInputExamplesDatadogAgent"
              UpdateInputExamplesDatagen:
                $ref: "#/components/examples/UpdateInputExamplesDatagen"
              UpdateInputExamplesEdgePrometheus:
                $ref: "#/components/examples/UpdateInputExamplesEdgePrometheus"
              UpdateInputExamplesElastic:
                $ref: "#/components/examples/UpdateInputExamplesElastic"
              UpdateInputExamplesEventhub:
                $ref: "#/components/examples/UpdateInputExamplesEventhub"
              UpdateInputExamplesEventhubAmqp:
                $ref: "#/components/examples/UpdateInputExamplesEventhubAmqp"
              UpdateInputExamplesExec:
                $ref: "#/components/examples/UpdateInputExamplesExec"
              UpdateInputExamplesFile:
                $ref: "#/components/examples/UpdateInputExamplesFile"
              UpdateInputExamplesFirehose:
                $ref: "#/components/examples/UpdateInputExamplesFirehose"
              UpdateInputExamplesGrafana:
                $ref: "#/components/examples/UpdateInputExamplesGrafana"
              UpdateInputExamplesGooglePubsub:
                $ref: "#/components/examples/UpdateInputExamplesGooglePubsub"
              UpdateInputExamplesHttp:
                $ref: "#/components/examples/UpdateInputExamplesHttp"
              UpdateInputExamplesHttpRaw:
                $ref: "#/components/examples/UpdateInputExamplesHttpRaw"
              UpdateInputExamplesJournalFiles:
                $ref: "#/components/examples/UpdateInputExamplesJournalFiles"
              UpdateInputExamplesKafka:
                $ref: "#/components/examples/UpdateInputExamplesKafka"
              UpdateInputExamplesKinesis:
                $ref: "#/components/examples/UpdateInputExamplesKinesis"
              UpdateInputExamplesKubeEvents:
                $ref: "#/components/examples/UpdateInputExamplesKubeEvents"
              UpdateInputExamplesKubeLogs:
                $ref: "#/components/examples/UpdateInputExamplesKubeLogs"
              UpdateInputExamplesKubeMetrics:
                $ref: "#/components/examples/UpdateInputExamplesKubeMetrics"
              UpdateInputExamplesLoki:
                $ref: "#/components/examples/UpdateInputExamplesLoki"
              UpdateInputExamplesMetrics:
                $ref: "#/components/examples/UpdateInputExamplesMetrics"
              UpdateInputExamplesModelDrivenTelemetry:
                $ref: "#/components/examples/UpdateInputExamplesModelDrivenTelemetry"
              UpdateInputExamplesMsk:
                $ref: "#/components/examples/UpdateInputExamplesMsk"
              UpdateInputExamplesNetflow:
                $ref: "#/components/examples/UpdateInputExamplesNetflow"
              UpdateInputExamplesOffice365Mgmt:
                $ref: "#/components/examples/UpdateInputExamplesOffice365Mgmt"
              UpdateInputExamplesMicrosoftGraph:
                $ref: "#/components/examples/UpdateInputExamplesMicrosoftGraph"
              UpdateInputExamplesOffice365MsgTrace:
                $ref: "#/components/examples/UpdateInputExamplesOffice365MsgTrace"
              UpdateInputExamplesOffice365Service:
                $ref: "#/components/examples/UpdateInputExamplesOffice365Service"
              UpdateInputExamplesOkta:
                $ref: "#/components/examples/UpdateInputExamplesOkta"
              UpdateInputExamplesOpenAI:
                $ref: "#/components/examples/UpdateInputExamplesOpenAI"
              UpdateInputExamplesOpenAIComplianceLogs:
                $ref: "#/components/examples/UpdateInputExamplesOpenAIComplianceLogs"
              UpdateInputExamplesOpenTelemetry:
                $ref: "#/components/examples/UpdateInputExamplesOpenTelemetry"
              UpdateInputExamplesPrometheus:
                $ref: "#/components/examples/UpdateInputExamplesPrometheus"
              UpdateInputExamplesPrometheusRw:
                $ref: "#/components/examples/UpdateInputExamplesPrometheusRw"
              UpdateInputExamplesRawUdp:
                $ref: "#/components/examples/UpdateInputExamplesRawUdp"
              UpdateInputExamplesS3:
                $ref: "#/components/examples/UpdateInputExamplesS3"
              UpdateInputExamplesS3Inventory:
                $ref: "#/components/examples/UpdateInputExamplesS3Inventory"
              UpdateInputExamplesSecurityLake:
                $ref: "#/components/examples/UpdateInputExamplesSecurityLake"
              UpdateInputExamplesServiceNowTable:
                $ref: "#/components/examples/UpdateInputExamplesServiceNowTable"
              UpdateInputExamplesSnmp:
                $ref: "#/components/examples/UpdateInputExamplesSnmp"
              UpdateInputExamplesSplunk:
                $ref: "#/components/examples/UpdateInputExamplesSplunk"
              UpdateInputExamplesSplunkHec:
                $ref: "#/components/examples/UpdateInputExamplesSplunkHec"
              UpdateInputExamplesSplunkSearch:
                $ref: "#/components/examples/UpdateInputExamplesSplunkSearch"
              UpdateInputExamplesSqs:
                $ref: "#/components/examples/UpdateInputExamplesSqs"
              UpdateInputExamplesSyslog:
                $ref: "#/components/examples/UpdateInputExamplesSyslog"
              UpdateInputExamplesSystemMetrics:
                $ref: "#/components/examples/UpdateInputExamplesSystemMetrics"
              UpdateInputExamplesSystemState:
                $ref: "#/components/examples/UpdateInputExamplesSystemState"
              UpdateInputExamplesTcp:
                $ref: "#/components/examples/UpdateInputExamplesTcp"
              UpdateInputExamplesTcpjson:
                $ref: "#/components/examples/UpdateInputExamplesTcpjson"
              UpdateInputExamplesWef:
                $ref: "#/components/examples/UpdateInputExamplesWef"
              UpdateInputExamplesWinEventLogs:
                $ref: "#/components/examples/UpdateInputExamplesWinEventLogs"
              UpdateInputExamplesWindowsMetrics:
                $ref: "#/components/examples/UpdateInputExamplesWindowsMetrics"
              UpdateInputExamplesWiz:
                $ref: "#/components/examples/UpdateInputExamplesWiz"
              UpdateInputExamplesWizWebhook:
                $ref: "#/components/examples/UpdateInputExamplesWizWebhook"
              UpdateInputExamplesZscalerHec:
                $ref: "#/components/examples/UpdateInputExamplesZscalerHec"
      responses:
        "200":
          description: the updated Source object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteInputSystemByPackAndId
      x-speakeasy-group: packs.sources
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - sources
      summary: Delete a Source within a Pack
      description: Delete the specified Source within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: the deleted Source object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/system/inputs/{id}/hectoken:
    post:
      operationId: createInputSystemHecTokenByPackAndId
      tags:
        - sources
      x-speakeasy-group: packs.sources.hecTokens
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Add an HEC token and optional metadata to a Splunk HEC Source within a
        Pack
      description: Add an HEC token and optional metadata to the specified Splunk HEC
        Source within the specified Pack.
      responses:
        "200":
          description: the updated Splunk HEC Source with the new HEC token
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputSplunkHec"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AddHecTokenRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AddHecTokenRequest"
            examples:
              HecTokenExamplesHecToken:
                $ref: "#/components/examples/HecTokenExamplesHecToken"
              HecTokenExamplesHecTokenWithIndexAccess:
                $ref: "#/components/examples/HecTokenExamplesHecTokenWithIndexAccess"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Splunk HEC Source.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/inputs/{id}/pq:
    delete:
      operationId: deleteInputSystemPqByPackAndId
      tags:
        - sources
      x-speakeasy-group: packs.sources.pq
      x-speakeasy-name-override: clear
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Clear the persistent queue for a Source within a Pack
      description: Clear the persistent queue (PQ) for the specified Source within the
        specified Pack.
      responses:
        "201":
          description: A list of job ids for the background job that clears the persistent
            queue
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to clear the PQ for.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getInputSystemPqByPackAndId
      tags:
        - sources
      x-speakeasy-group: packs.sources.pq
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get information about the latest job to clear the persistent queue for
        a Source within a Pack
      description: Get information about the latest job to clear the persistent queue
        (PQ) for the specified Source within the specified Pack.
      responses:
        "200":
          description: information about the latest job to clear the PQ for the Source
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedJobInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to get PQ job information for.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/inputs/{id}/hectoken/{token}:
    patch:
      operationId: updateInputSystemHecTokenByPackAndIdAndToken
      tags:
        - sources
      x-speakeasy-group: packs.sources.hecTokens
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update metadata for an HEC token for a Splunk HEC Source within a Pack
      description: Update the metadata for the specified HEC token for the specified
        Splunk HEC Source within the specified Pack.
      responses:
        "200":
          description: the updated HEC token
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputSplunkHec"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: UpdateHecTokenRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateHecTokenRequest"
            examples:
              HecTokenExamplesHecToken:
                $ref: "#/components/examples/HecTokenExamplesHecToken"
              HecTokenExamplesHecTokenWithIndexAccess:
                $ref: "#/components/examples/HecTokenExamplesHecTokenWithIndexAccess"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Splunk HEC Source.
        - name: token
          in: path
          required: true
          schema:
            type: string
          description: The HEC token value to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /system/iometrics:
    get:
      operationId: listIoMetricsEntry
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - iometrics
      summary: Get a list of IoMetricsEntry objects
      description: Get a list of IoMetricsEntry objects.
      responses:
        "200":
          description: List of IoMetricsEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedIoMetricsEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/iometrics/{id}:
    get:
      operationId: getIoMetricsEntryById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - iometrics
      summary: Get IoMetricsEntry by ID
      description: Get IoMetricsEntry by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of IoMetricsEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedIoMetricsEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateIoMetricsEntryById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - iometrics
      summary: Update IoMetricsEntry
      description: Update IoMetricsEntry.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to PATCH
      requestBody:
        description: IoMetricsEntry object to be updated.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/IoMetricsEntry"
      responses:
        "200":
          description: The updated IoMetricsEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedIoMetricsEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteIoMetricsEntryById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - iometrics
      summary: Delete IoMetricsEntry
      description: Delete IoMetricsEntry.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted IoMetricsEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedIoMetricsEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/outputs:
    get:
      operationId: listOutput
      x-speakeasy-group: destinations
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - destinations
      summary: List all Destinations
      description: Get a list of all Destinations.
      responses:
        "200":
          description: a list of Destination objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/DestinationType"
          description: Type of Destination to include in the results. Each request can
            include only one <code>type</code> parameter; multiple parameters
            per request are not supported.
    post:
      operationId: createOutput
      x-speakeasy-group: destinations
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - destinations
      summary: Create a Destination
      description: Create a new Destination.
      requestBody:
        description: Output object.
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: "#/components/schemas/Output"
                - type: object
                  required:
                    - id
            examples:
              OutputCreateExamplesTcpjson:
                $ref: "#/components/examples/OutputCreateExamplesTcpjson"
              OutputCreateExamplesSplunk:
                $ref: "#/components/examples/OutputCreateExamplesSplunk"
              OutputCreateExamplesSplunkLb:
                $ref: "#/components/examples/OutputCreateExamplesSplunkLb"
              OutputCreateExamplesSplunkHec:
                $ref: "#/components/examples/OutputCreateExamplesSplunkHec"
              OutputCreateExamplesSyslog:
                $ref: "#/components/examples/OutputCreateExamplesSyslog"
              OutputCreateExamplesFilesystem:
                $ref: "#/components/examples/OutputCreateExamplesFilesystem"
              OutputCreateExamplesS3:
                $ref: "#/components/examples/OutputCreateExamplesS3"
              OutputCreateExamplesNutanixObjects:
                $ref: "#/components/examples/OutputCreateExamplesNutanixObjects"
              OutputCreateExamplesStorjS3:
                $ref: "#/components/examples/OutputCreateExamplesStorjS3"
              OutputCreateExamplesAlphasocS3:
                $ref: "#/components/examples/OutputCreateExamplesAlphasocS3"
              OutputCreateExamplesdellS3:
                $ref: "#/components/examples/OutputCreateExamplesdellS3"
              OutputCreateExamplescloudianS3:
                $ref: "#/components/examples/OutputCreateExamplescloudianS3"
              OutputCreateExamplesscalityS3:
                $ref: "#/components/examples/OutputCreateExamplesscalityS3"
              OutputCreateExamplesalibabaCloudS3:
                $ref: "#/components/examples/OutputCreateExamplesalibabaCloudS3"
              OutputCreateExamplesAzureBlob:
                $ref: "#/components/examples/OutputCreateExamplesAzureBlob"
              OutputCreateExamplesAzureDataExplorer:
                $ref: "#/components/examples/OutputCreateExamplesAzureDataExplorer"
              OutputCreateExamplesSentinel:
                $ref: "#/components/examples/OutputCreateExamplesSentinel"
              OutputCreateExamplesAzureLogs:
                $ref: "#/components/examples/OutputCreateExamplesAzureLogs"
              OutputCreateExamplesKafka:
                $ref: "#/components/examples/OutputCreateExamplesKafka"
              OutputCreateExamplesConfluentCloud:
                $ref: "#/components/examples/OutputCreateExamplesConfluentCloud"
              OutputCreateExamplesMsk:
                $ref: "#/components/examples/OutputCreateExamplesMsk"
              OutputCreateExamplesKinesis:
                $ref: "#/components/examples/OutputCreateExamplesKinesis"
              OutputCreateExamplesElastic:
                $ref: "#/components/examples/OutputCreateExamplesElastic"
              OutputCreateExamplesElasticCloud:
                $ref: "#/components/examples/OutputCreateExamplesElasticCloud"
              OutputCreateExamplesMicrosoftFabric:
                $ref: "#/components/examples/OutputCreateExamplesMicrosoftFabric"
              OutputCreateExamplesCloudflareR2:
                $ref: "#/components/examples/OutputCreateExamplesCloudflareR2"
              OutputCreateExamplesHoneycomb:
                $ref: "#/components/examples/OutputCreateExamplesHoneycomb"
              OutputCreateExamplesNewrelic:
                $ref: "#/components/examples/OutputCreateExamplesNewrelic"
              OutputCreateExamplesNewrelicEvents:
                $ref: "#/components/examples/OutputCreateExamplesNewrelicEvents"
              OutputCreateExamplesSnmp:
                $ref: "#/components/examples/OutputCreateExamplesSnmp"
              OutputCreateExamplesInfluxdb:
                $ref: "#/components/examples/OutputCreateExamplesInfluxdb"
              OutputCreateExamplesMinio:
                $ref: "#/components/examples/OutputCreateExamplesMinio"
              OutputCreateExamplesCloudwatch:
                $ref: "#/components/examples/OutputCreateExamplesCloudwatch"
              OutputCreateExamplesAzureEventhub:
                $ref: "#/components/examples/OutputCreateExamplesAzureEventhub"
              OutputCreateExamplesStatsd:
                $ref: "#/components/examples/OutputCreateExamplesStatsd"
              OutputCreateExamplesStatsdExt:
                $ref: "#/components/examples/OutputCreateExamplesStatsdExt"
              OutputCreateExamplesGraphite:
                $ref: "#/components/examples/OutputCreateExamplesGraphite"
              OutputCreateExamplesWavefront:
                $ref: "#/components/examples/OutputCreateExamplesWavefront"
              OutputCreateExamplesSignalfx:
                $ref: "#/components/examples/OutputCreateExamplesSignalfx"
              OutputCreateExamplesSqs:
                $ref: "#/components/examples/OutputCreateExamplesSqs"
              OutputCreateExamplesGoogleCloudStorage:
                $ref: "#/components/examples/OutputCreateExamplesGoogleCloudStorage"
              OutputCreateExamplesSumoLogic:
                $ref: "#/components/examples/OutputCreateExamplesSumoLogic"
              OutputCreateExamplesDatadog:
                $ref: "#/components/examples/OutputCreateExamplesDatadog"
              OutputCreateExamplesWebhook:
                $ref: "#/components/examples/OutputCreateExamplesWebhook"
              OutputCreateExamplesPrometheus:
                $ref: "#/components/examples/OutputCreateExamplesPrometheus"
              OutputCreateExamplesGooglePubsub:
                $ref: "#/components/examples/OutputCreateExamplesGooglePubsub"
              OutputCreateExamplesGoogleChronicle:
                $ref: "#/components/examples/OutputCreateExamplesGoogleChronicle"
              OutputCreateExamplesChronicle:
                $ref: "#/components/examples/OutputCreateExamplesChronicle"
              OutputCreateExamplesGrafanaCloud:
                $ref: "#/components/examples/OutputCreateExamplesGrafanaCloud"
              OutputCreateExamplesLoki:
                $ref: "#/components/examples/OutputCreateExamplesLoki"
              OutputCreateExamplesOpenTelemetry:
                $ref: "#/components/examples/OutputCreateExamplesOpenTelemetry"
              OutputCreateExamplesServiceNow:
                $ref: "#/components/examples/OutputCreateExamplesServiceNow"
              OutputCreateExamplesDynatraceOtlp:
                $ref: "#/components/examples/OutputCreateExamplesDynatraceOtlp"
              OutputCreateExamplesGoogleCloudObservability:
                $ref: "#/components/examples/OutputCreateExamplesGoogleCloudObservability"
              OutputCreateExamplesSentinelOneAiSiem:
                $ref: "#/components/examples/OutputCreateExamplesSentinelOneAiSiem"
              OutputCreateExamplesDataset:
                $ref: "#/components/examples/OutputCreateExamplesDataset"
              OutputCreateExamplesRing:
                $ref: "#/components/examples/OutputCreateExamplesRing"
              OutputCreateExamplesRouter:
                $ref: "#/components/examples/OutputCreateExamplesRouter"
              OutputCreateExamplesWizHec:
                $ref: "#/components/examples/OutputCreateExamplesWizHec"
              OutputCreateExamplesHumioHec:
                $ref: "#/components/examples/OutputCreateExamplesHumioHec"
              OutputCreateExamplesCrowdstrikeNextGenSiem:
                $ref: "#/components/examples/OutputCreateExamplesCrowdstrikeNextGenSiem"
              OutputCreateExamplesCriblHttp:
                $ref: "#/components/examples/OutputCreateExamplesCriblHttp"
              OutputCreateExamplesCriblTcp:
                $ref: "#/components/examples/OutputCreateExamplesCriblTcp"
              OutputCreateExamplesCriblSearchEngine:
                $ref: "#/components/examples/OutputCreateExamplesCriblSearchEngine"
              OutputCreateExamplesGoogleCloudLogging:
                $ref: "#/components/examples/OutputCreateExamplesGoogleCloudLogging"
              OutputCreateExamplesSns:
                $ref: "#/components/examples/OutputCreateExamplesSns"
              OutputCreateExamplesDlS3:
                $ref: "#/components/examples/OutputCreateExamplesDlS3"
              OutputCreateExamplesSecurityLake:
                $ref: "#/components/examples/OutputCreateExamplesSecurityLake"
              OutputCreateExamplesCriblLake:
                $ref: "#/components/examples/OutputCreateExamplesCriblLake"
              OutputCreateExamplesExabeam:
                $ref: "#/components/examples/OutputCreateExamplesExabeam"
              OutputCreateExamplesDiskSpool:
                $ref: "#/components/examples/OutputCreateExamplesDiskSpool"
              OutputCreateExamplesClickHouse:
                $ref: "#/components/examples/OutputCreateExamplesClickHouse"
              OutputCreateExamplesLocalSearchStorage:
                $ref: "#/components/examples/OutputCreateExamplesLocalSearchStorage"
              OutputCreateExamplesXsiam:
                $ref: "#/components/examples/OutputCreateExamplesXsiam"
              OutputCreateExamplesNetflow:
                $ref: "#/components/examples/OutputCreateExamplesNetflow"
              OutputCreateExamplesDynatraceHttp:
                $ref: "#/components/examples/OutputCreateExamplesDynatraceHttp"
              OutputCreateExamplesDatabricks:
                $ref: "#/components/examples/OutputCreateExamplesDatabricks"
      responses:
        "200":
          description: the created Destination object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/outputs/{id}:
    get:
      operationId: getOutputById
      x-speakeasy-group: destinations
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - destinations
      summary: Get a Destination
      description: Get the specified Destination.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to get.
      responses:
        "200":
          description: a Destination object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateOutputById
      x-speakeasy-group: destinations
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - destinations
      summary: Update a Destination
      description: Update the specified Destination.<br/><br/>Provide a complete
        representation of the Destination that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Destination.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Destination
        might not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to update.
      requestBody:
        description: Output object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Output"
            examples:
              UpdateOutputExamplesDefault:
                $ref: "#/components/examples/UpdateOutputExamplesDefault"
              UpdateOutputExamplesTcpjson:
                $ref: "#/components/examples/UpdateOutputExamplesTcpjson"
              UpdateOutputExamplesSplunk:
                $ref: "#/components/examples/UpdateOutputExamplesSplunk"
              UpdateOutputExamplesSplunkLb:
                $ref: "#/components/examples/UpdateOutputExamplesSplunkLb"
              UpdateOutputExamplesSplunkHec:
                $ref: "#/components/examples/UpdateOutputExamplesSplunkHec"
              UpdateOutputExamplesSyslog:
                $ref: "#/components/examples/UpdateOutputExamplesSyslog"
              UpdateOutputExamplesFilesystem:
                $ref: "#/components/examples/UpdateOutputExamplesFilesystem"
              UpdateOutputExamplesS3:
                $ref: "#/components/examples/UpdateOutputExamplesS3"
              UpdateOutputExamplesNutanixObjects:
                $ref: "#/components/examples/UpdateOutputExamplesNutanixObjects"
              UpdateOutputExamplesStorjS3:
                $ref: "#/components/examples/UpdateOutputExamplesStorjS3"
              UpdateOutputExamplesAlphasocS3:
                $ref: "#/components/examples/UpdateOutputExamplesAlphasocS3"
              UpdateOutputExamplesdellS3:
                $ref: "#/components/examples/UpdateOutputExamplesdellS3"
              UpdateOutputExamplescloudianS3:
                $ref: "#/components/examples/UpdateOutputExamplescloudianS3"
              UpdateOutputExamplesscalityS3:
                $ref: "#/components/examples/UpdateOutputExamplesscalityS3"
              UpdateOutputExamplesalibabaCloudS3:
                $ref: "#/components/examples/UpdateOutputExamplesalibabaCloudS3"
              UpdateOutputExamplesAzureBlob:
                $ref: "#/components/examples/UpdateOutputExamplesAzureBlob"
              UpdateOutputExamplesAzureDataExplorer:
                $ref: "#/components/examples/UpdateOutputExamplesAzureDataExplorer"
              UpdateOutputExamplesSentinel:
                $ref: "#/components/examples/UpdateOutputExamplesSentinel"
              UpdateOutputExamplesAzureLogs:
                $ref: "#/components/examples/UpdateOutputExamplesAzureLogs"
              UpdateOutputExamplesKafka:
                $ref: "#/components/examples/UpdateOutputExamplesKafka"
              UpdateOutputExamplesConfluentCloud:
                $ref: "#/components/examples/UpdateOutputExamplesConfluentCloud"
              UpdateOutputExamplesMsk:
                $ref: "#/components/examples/UpdateOutputExamplesMsk"
              UpdateOutputExamplesKinesis:
                $ref: "#/components/examples/UpdateOutputExamplesKinesis"
              UpdateOutputExamplesElastic:
                $ref: "#/components/examples/UpdateOutputExamplesElastic"
              UpdateOutputExamplesElasticCloud:
                $ref: "#/components/examples/UpdateOutputExamplesElasticCloud"
              UpdateOutputExamplesMicrosoftFabric:
                $ref: "#/components/examples/UpdateOutputExamplesMicrosoftFabric"
              UpdateOutputExamplesCloudflareR2:
                $ref: "#/components/examples/UpdateOutputExamplesCloudflareR2"
              UpdateOutputExamplesHoneycomb:
                $ref: "#/components/examples/UpdateOutputExamplesHoneycomb"
              UpdateOutputExamplesNewrelic:
                $ref: "#/components/examples/UpdateOutputExamplesNewrelic"
              UpdateOutputExamplesNewrelicEvents:
                $ref: "#/components/examples/UpdateOutputExamplesNewrelicEvents"
              UpdateOutputExamplesSnmp:
                $ref: "#/components/examples/UpdateOutputExamplesSnmp"
              UpdateOutputExamplesInfluxdb:
                $ref: "#/components/examples/UpdateOutputExamplesInfluxdb"
              UpdateOutputExamplesMinio:
                $ref: "#/components/examples/UpdateOutputExamplesMinio"
              UpdateOutputExamplesCloudwatch:
                $ref: "#/components/examples/UpdateOutputExamplesCloudwatch"
              UpdateOutputExamplesAzureEventhub:
                $ref: "#/components/examples/UpdateOutputExamplesAzureEventhub"
              UpdateOutputExamplesStatsd:
                $ref: "#/components/examples/UpdateOutputExamplesStatsd"
              UpdateOutputExamplesStatsdExt:
                $ref: "#/components/examples/UpdateOutputExamplesStatsdExt"
              UpdateOutputExamplesGraphite:
                $ref: "#/components/examples/UpdateOutputExamplesGraphite"
              UpdateOutputExamplesWavefront:
                $ref: "#/components/examples/UpdateOutputExamplesWavefront"
              UpdateOutputExamplesSignalfx:
                $ref: "#/components/examples/UpdateOutputExamplesSignalfx"
              UpdateOutputExamplesSqs:
                $ref: "#/components/examples/UpdateOutputExamplesSqs"
              UpdateOutputExamplesGoogleCloudStorage:
                $ref: "#/components/examples/UpdateOutputExamplesGoogleCloudStorage"
              UpdateOutputExamplesSumoLogic:
                $ref: "#/components/examples/UpdateOutputExamplesSumoLogic"
              UpdateOutputExamplesDatadog:
                $ref: "#/components/examples/UpdateOutputExamplesDatadog"
              UpdateOutputExamplesWebhook:
                $ref: "#/components/examples/UpdateOutputExamplesWebhook"
              UpdateOutputExamplesPrometheus:
                $ref: "#/components/examples/UpdateOutputExamplesPrometheus"
              UpdateOutputExamplesGooglePubsub:
                $ref: "#/components/examples/UpdateOutputExamplesGooglePubsub"
              UpdateOutputExamplesGoogleChronicle:
                $ref: "#/components/examples/UpdateOutputExamplesGoogleChronicle"
              UpdateOutputExamplesChronicle:
                $ref: "#/components/examples/UpdateOutputExamplesChronicle"
              UpdateOutputExamplesGrafanaCloud:
                $ref: "#/components/examples/UpdateOutputExamplesGrafanaCloud"
              UpdateOutputExamplesLoki:
                $ref: "#/components/examples/UpdateOutputExamplesLoki"
              UpdateOutputExamplesOpenTelemetry:
                $ref: "#/components/examples/UpdateOutputExamplesOpenTelemetry"
              UpdateOutputExamplesServiceNow:
                $ref: "#/components/examples/UpdateOutputExamplesServiceNow"
              UpdateOutputExamplesDynatraceOtlp:
                $ref: "#/components/examples/UpdateOutputExamplesDynatraceOtlp"
              UpdateOutputExamplesGoogleCloudObservability:
                $ref: "#/components/examples/UpdateOutputExamplesGoogleCloudObservability"
              UpdateOutputExamplesSentinelOneAiSiem:
                $ref: "#/components/examples/UpdateOutputExamplesSentinelOneAiSiem"
              UpdateOutputExamplesDataset:
                $ref: "#/components/examples/UpdateOutputExamplesDataset"
              UpdateOutputExamplesRing:
                $ref: "#/components/examples/UpdateOutputExamplesRing"
              UpdateOutputExamplesRouter:
                $ref: "#/components/examples/UpdateOutputExamplesRouter"
              UpdateOutputExamplesWizHec:
                $ref: "#/components/examples/UpdateOutputExamplesWizHec"
              UpdateOutputExamplesHumioHec:
                $ref: "#/components/examples/UpdateOutputExamplesHumioHec"
              UpdateOutputExamplesCrowdstrikeNextGenSiem:
                $ref: "#/components/examples/UpdateOutputExamplesCrowdstrikeNextGenSiem"
              UpdateOutputExamplesCriblHttp:
                $ref: "#/components/examples/UpdateOutputExamplesCriblHttp"
              UpdateOutputExamplesCriblTcp:
                $ref: "#/components/examples/UpdateOutputExamplesCriblTcp"
              UpdateOutputExamplesCriblSearchEngine:
                $ref: "#/components/examples/UpdateOutputExamplesCriblSearchEngine"
              UpdateOutputExamplesGoogleCloudLogging:
                $ref: "#/components/examples/UpdateOutputExamplesGoogleCloudLogging"
              UpdateOutputExamplesSns:
                $ref: "#/components/examples/UpdateOutputExamplesSns"
              UpdateOutputExamplesDlS3:
                $ref: "#/components/examples/UpdateOutputExamplesDlS3"
              UpdateOutputExamplesSecurityLake:
                $ref: "#/components/examples/UpdateOutputExamplesSecurityLake"
              UpdateOutputExamplesCriblLake:
                $ref: "#/components/examples/UpdateOutputExamplesCriblLake"
              UpdateOutputExamplesExabeam:
                $ref: "#/components/examples/UpdateOutputExamplesExabeam"
              UpdateOutputExamplesDiskSpool:
                $ref: "#/components/examples/UpdateOutputExamplesDiskSpool"
              UpdateOutputExamplesClickHouse:
                $ref: "#/components/examples/UpdateOutputExamplesClickHouse"
              UpdateOutputExamplesLocalSearchStorage:
                $ref: "#/components/examples/UpdateOutputExamplesLocalSearchStorage"
              UpdateOutputExamplesXsiam:
                $ref: "#/components/examples/UpdateOutputExamplesXsiam"
              UpdateOutputExamplesNetflow:
                $ref: "#/components/examples/UpdateOutputExamplesNetflow"
              UpdateOutputExamplesDynatraceHttp:
                $ref: "#/components/examples/UpdateOutputExamplesDynatraceHttp"
              UpdateOutputExamplesDatabricks:
                $ref: "#/components/examples/UpdateOutputExamplesDatabricks"
      responses:
        "200":
          description: the updated Destination object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteOutputById
      x-speakeasy-group: destinations
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - destinations
      summary: Delete a Destination
      description: Delete the specified Destination.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to delete.
      responses:
        "200":
          description: the deleted Destination object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/outputs/{id}/pq:
    delete:
      operationId: deleteOutputPqById
      tags:
        - destinations
      x-speakeasy-group: destinations.pq
      x-speakeasy-name-override: clear
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Clear the persistent queue for a Destination
      description: Clear the persistent queue (PQ) for the specified Destination.
      responses:
        "201":
          description: A list of job ids for the background job that clears the persistent
            queue
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to clear the PQ for.
    get:
      operationId: getOutputPqById
      tags:
        - destinations
      x-speakeasy-group: destinations.pq
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get information about the latest job to clear the persistent queue for
        a Destination
      description: Get information about the latest job to clear the persistent queue
        (PQ) for the specified Destination.
      responses:
        "200":
          description: information about the latest PQ clear job for the Destination
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedJobInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to get PQ job information for.
  /system/outputs/{id}/samples:
    get:
      operationId: getOutputSamplesById
      tags:
        - destinations
      x-speakeasy-group: destinations.samples
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get sample event data for a Destination
      description: Get sample event data for the specified Destination to validate the
        configuration or test connectivity.
      responses:
        "200":
          description: Sample event data for the Destination
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputSamplesResponse"
        "400":
          description: Bad Request — invalid request or Destination error
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to get sample event data for.
  /system/outputs/{id}/test:
    post:
      operationId: createOutputTestById
      tags:
        - destinations
      x-speakeasy-group: destinations.samples
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Send sample event data to a Destination
      description: Send sample event data to the specified Destination to validate the
        configuration or test connectivity.
      responses:
        "200":
          description: Destination test result
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputTestResponse"
        "400":
          description: Bad Request — missing or invalid events
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: OutputTestRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/OutputTestRequest"
            examples:
              OutputTestExamplesSingleEvent:
                $ref: "#/components/examples/OutputTestExamplesSingleEvent"
              OutputTestExamplesMultipleEvents:
                $ref: "#/components/examples/OutputTestExamplesMultipleEvents"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to send sample event data to.
  /p/{pack}/system/outputs:
    get:
      operationId: getOutputSystemByPack
      x-speakeasy-group: packs.destinations
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - destinations
      summary: List all Destinations within a Pack
      description: Get a list of all Destinations within the specified Pack.
      responses:
        "200":
          description: a list of Destination objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/DestinationType"
          description: Type of Destination to include in the results. Each request can
            include only one <code>type</code> parameter; multiple parameters
            per request are not supported.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    post:
      operationId: createOutputSystemByPack
      x-speakeasy-group: packs.destinations
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - destinations
      summary: Create a Destination within a Pack
      description: Create a new Destination within the specified Pack.
      requestBody:
        description: Output object.
        required: true
        content:
          application/json:
            schema:
              allOf:
                - $ref: "#/components/schemas/Output"
                - type: object
                  required:
                    - id
            examples:
              OutputCreateExamplesTcpjson:
                $ref: "#/components/examples/OutputCreateExamplesTcpjson"
              OutputCreateExamplesSplunk:
                $ref: "#/components/examples/OutputCreateExamplesSplunk"
              OutputCreateExamplesSplunkLb:
                $ref: "#/components/examples/OutputCreateExamplesSplunkLb"
              OutputCreateExamplesSplunkHec:
                $ref: "#/components/examples/OutputCreateExamplesSplunkHec"
              OutputCreateExamplesSyslog:
                $ref: "#/components/examples/OutputCreateExamplesSyslog"
              OutputCreateExamplesFilesystem:
                $ref: "#/components/examples/OutputCreateExamplesFilesystem"
              OutputCreateExamplesS3:
                $ref: "#/components/examples/OutputCreateExamplesS3"
              OutputCreateExamplesNutanixObjects:
                $ref: "#/components/examples/OutputCreateExamplesNutanixObjects"
              OutputCreateExamplesStorjS3:
                $ref: "#/components/examples/OutputCreateExamplesStorjS3"
              OutputCreateExamplesAlphasocS3:
                $ref: "#/components/examples/OutputCreateExamplesAlphasocS3"
              OutputCreateExamplesdellS3:
                $ref: "#/components/examples/OutputCreateExamplesdellS3"
              OutputCreateExamplescloudianS3:
                $ref: "#/components/examples/OutputCreateExamplescloudianS3"
              OutputCreateExamplesscalityS3:
                $ref: "#/components/examples/OutputCreateExamplesscalityS3"
              OutputCreateExamplesalibabaCloudS3:
                $ref: "#/components/examples/OutputCreateExamplesalibabaCloudS3"
              OutputCreateExamplesAzureBlob:
                $ref: "#/components/examples/OutputCreateExamplesAzureBlob"
              OutputCreateExamplesAzureDataExplorer:
                $ref: "#/components/examples/OutputCreateExamplesAzureDataExplorer"
              OutputCreateExamplesSentinel:
                $ref: "#/components/examples/OutputCreateExamplesSentinel"
              OutputCreateExamplesAzureLogs:
                $ref: "#/components/examples/OutputCreateExamplesAzureLogs"
              OutputCreateExamplesKafka:
                $ref: "#/components/examples/OutputCreateExamplesKafka"
              OutputCreateExamplesConfluentCloud:
                $ref: "#/components/examples/OutputCreateExamplesConfluentCloud"
              OutputCreateExamplesMsk:
                $ref: "#/components/examples/OutputCreateExamplesMsk"
              OutputCreateExamplesKinesis:
                $ref: "#/components/examples/OutputCreateExamplesKinesis"
              OutputCreateExamplesElastic:
                $ref: "#/components/examples/OutputCreateExamplesElastic"
              OutputCreateExamplesElasticCloud:
                $ref: "#/components/examples/OutputCreateExamplesElasticCloud"
              OutputCreateExamplesMicrosoftFabric:
                $ref: "#/components/examples/OutputCreateExamplesMicrosoftFabric"
              OutputCreateExamplesCloudflareR2:
                $ref: "#/components/examples/OutputCreateExamplesCloudflareR2"
              OutputCreateExamplesHoneycomb:
                $ref: "#/components/examples/OutputCreateExamplesHoneycomb"
              OutputCreateExamplesNewrelic:
                $ref: "#/components/examples/OutputCreateExamplesNewrelic"
              OutputCreateExamplesNewrelicEvents:
                $ref: "#/components/examples/OutputCreateExamplesNewrelicEvents"
              OutputCreateExamplesSnmp:
                $ref: "#/components/examples/OutputCreateExamplesSnmp"
              OutputCreateExamplesInfluxdb:
                $ref: "#/components/examples/OutputCreateExamplesInfluxdb"
              OutputCreateExamplesMinio:
                $ref: "#/components/examples/OutputCreateExamplesMinio"
              OutputCreateExamplesCloudwatch:
                $ref: "#/components/examples/OutputCreateExamplesCloudwatch"
              OutputCreateExamplesAzureEventhub:
                $ref: "#/components/examples/OutputCreateExamplesAzureEventhub"
              OutputCreateExamplesStatsd:
                $ref: "#/components/examples/OutputCreateExamplesStatsd"
              OutputCreateExamplesStatsdExt:
                $ref: "#/components/examples/OutputCreateExamplesStatsdExt"
              OutputCreateExamplesGraphite:
                $ref: "#/components/examples/OutputCreateExamplesGraphite"
              OutputCreateExamplesWavefront:
                $ref: "#/components/examples/OutputCreateExamplesWavefront"
              OutputCreateExamplesSignalfx:
                $ref: "#/components/examples/OutputCreateExamplesSignalfx"
              OutputCreateExamplesSqs:
                $ref: "#/components/examples/OutputCreateExamplesSqs"
              OutputCreateExamplesGoogleCloudStorage:
                $ref: "#/components/examples/OutputCreateExamplesGoogleCloudStorage"
              OutputCreateExamplesSumoLogic:
                $ref: "#/components/examples/OutputCreateExamplesSumoLogic"
              OutputCreateExamplesDatadog:
                $ref: "#/components/examples/OutputCreateExamplesDatadog"
              OutputCreateExamplesWebhook:
                $ref: "#/components/examples/OutputCreateExamplesWebhook"
              OutputCreateExamplesPrometheus:
                $ref: "#/components/examples/OutputCreateExamplesPrometheus"
              OutputCreateExamplesGooglePubsub:
                $ref: "#/components/examples/OutputCreateExamplesGooglePubsub"
              OutputCreateExamplesGoogleChronicle:
                $ref: "#/components/examples/OutputCreateExamplesGoogleChronicle"
              OutputCreateExamplesChronicle:
                $ref: "#/components/examples/OutputCreateExamplesChronicle"
              OutputCreateExamplesGrafanaCloud:
                $ref: "#/components/examples/OutputCreateExamplesGrafanaCloud"
              OutputCreateExamplesLoki:
                $ref: "#/components/examples/OutputCreateExamplesLoki"
              OutputCreateExamplesOpenTelemetry:
                $ref: "#/components/examples/OutputCreateExamplesOpenTelemetry"
              OutputCreateExamplesServiceNow:
                $ref: "#/components/examples/OutputCreateExamplesServiceNow"
              OutputCreateExamplesDynatraceOtlp:
                $ref: "#/components/examples/OutputCreateExamplesDynatraceOtlp"
              OutputCreateExamplesGoogleCloudObservability:
                $ref: "#/components/examples/OutputCreateExamplesGoogleCloudObservability"
              OutputCreateExamplesSentinelOneAiSiem:
                $ref: "#/components/examples/OutputCreateExamplesSentinelOneAiSiem"
              OutputCreateExamplesDataset:
                $ref: "#/components/examples/OutputCreateExamplesDataset"
              OutputCreateExamplesRing:
                $ref: "#/components/examples/OutputCreateExamplesRing"
              OutputCreateExamplesRouter:
                $ref: "#/components/examples/OutputCreateExamplesRouter"
              OutputCreateExamplesWizHec:
                $ref: "#/components/examples/OutputCreateExamplesWizHec"
              OutputCreateExamplesHumioHec:
                $ref: "#/components/examples/OutputCreateExamplesHumioHec"
              OutputCreateExamplesCrowdstrikeNextGenSiem:
                $ref: "#/components/examples/OutputCreateExamplesCrowdstrikeNextGenSiem"
              OutputCreateExamplesCriblHttp:
                $ref: "#/components/examples/OutputCreateExamplesCriblHttp"
              OutputCreateExamplesCriblTcp:
                $ref: "#/components/examples/OutputCreateExamplesCriblTcp"
              OutputCreateExamplesCriblSearchEngine:
                $ref: "#/components/examples/OutputCreateExamplesCriblSearchEngine"
              OutputCreateExamplesGoogleCloudLogging:
                $ref: "#/components/examples/OutputCreateExamplesGoogleCloudLogging"
              OutputCreateExamplesSns:
                $ref: "#/components/examples/OutputCreateExamplesSns"
              OutputCreateExamplesDlS3:
                $ref: "#/components/examples/OutputCreateExamplesDlS3"
              OutputCreateExamplesSecurityLake:
                $ref: "#/components/examples/OutputCreateExamplesSecurityLake"
              OutputCreateExamplesCriblLake:
                $ref: "#/components/examples/OutputCreateExamplesCriblLake"
              OutputCreateExamplesExabeam:
                $ref: "#/components/examples/OutputCreateExamplesExabeam"
              OutputCreateExamplesDiskSpool:
                $ref: "#/components/examples/OutputCreateExamplesDiskSpool"
              OutputCreateExamplesClickHouse:
                $ref: "#/components/examples/OutputCreateExamplesClickHouse"
              OutputCreateExamplesLocalSearchStorage:
                $ref: "#/components/examples/OutputCreateExamplesLocalSearchStorage"
              OutputCreateExamplesXsiam:
                $ref: "#/components/examples/OutputCreateExamplesXsiam"
              OutputCreateExamplesNetflow:
                $ref: "#/components/examples/OutputCreateExamplesNetflow"
              OutputCreateExamplesDynatraceHttp:
                $ref: "#/components/examples/OutputCreateExamplesDynatraceHttp"
              OutputCreateExamplesDatabricks:
                $ref: "#/components/examples/OutputCreateExamplesDatabricks"
      responses:
        "200":
          description: the created Destination object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/outputs/{id}:
    get:
      operationId: getOutputSystemByPackAndId
      x-speakeasy-group: packs.destinations
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - destinations
      summary: Get a Destination within a Pack
      description: Get the specified Destination within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to get.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: a Destination object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateOutputSystemByPackAndId
      x-speakeasy-group: packs.destinations
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - destinations
      summary: Update a Destination within a Pack
      description: Update the specified Destination.<br/><br/>Provide a complete
        representation of the Destination that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Destination.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Destination
        might not function as expected within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: Output object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Output"
            examples:
              UpdateOutputExamplesDefault:
                $ref: "#/components/examples/UpdateOutputExamplesDefault"
              UpdateOutputExamplesTcpjson:
                $ref: "#/components/examples/UpdateOutputExamplesTcpjson"
              UpdateOutputExamplesSplunk:
                $ref: "#/components/examples/UpdateOutputExamplesSplunk"
              UpdateOutputExamplesSplunkLb:
                $ref: "#/components/examples/UpdateOutputExamplesSplunkLb"
              UpdateOutputExamplesSplunkHec:
                $ref: "#/components/examples/UpdateOutputExamplesSplunkHec"
              UpdateOutputExamplesSyslog:
                $ref: "#/components/examples/UpdateOutputExamplesSyslog"
              UpdateOutputExamplesFilesystem:
                $ref: "#/components/examples/UpdateOutputExamplesFilesystem"
              UpdateOutputExamplesS3:
                $ref: "#/components/examples/UpdateOutputExamplesS3"
              UpdateOutputExamplesNutanixObjects:
                $ref: "#/components/examples/UpdateOutputExamplesNutanixObjects"
              UpdateOutputExamplesStorjS3:
                $ref: "#/components/examples/UpdateOutputExamplesStorjS3"
              UpdateOutputExamplesAlphasocS3:
                $ref: "#/components/examples/UpdateOutputExamplesAlphasocS3"
              UpdateOutputExamplesdellS3:
                $ref: "#/components/examples/UpdateOutputExamplesdellS3"
              UpdateOutputExamplescloudianS3:
                $ref: "#/components/examples/UpdateOutputExamplescloudianS3"
              UpdateOutputExamplesscalityS3:
                $ref: "#/components/examples/UpdateOutputExamplesscalityS3"
              UpdateOutputExamplesalibabaCloudS3:
                $ref: "#/components/examples/UpdateOutputExamplesalibabaCloudS3"
              UpdateOutputExamplesAzureBlob:
                $ref: "#/components/examples/UpdateOutputExamplesAzureBlob"
              UpdateOutputExamplesAzureDataExplorer:
                $ref: "#/components/examples/UpdateOutputExamplesAzureDataExplorer"
              UpdateOutputExamplesSentinel:
                $ref: "#/components/examples/UpdateOutputExamplesSentinel"
              UpdateOutputExamplesAzureLogs:
                $ref: "#/components/examples/UpdateOutputExamplesAzureLogs"
              UpdateOutputExamplesKafka:
                $ref: "#/components/examples/UpdateOutputExamplesKafka"
              UpdateOutputExamplesConfluentCloud:
                $ref: "#/components/examples/UpdateOutputExamplesConfluentCloud"
              UpdateOutputExamplesMsk:
                $ref: "#/components/examples/UpdateOutputExamplesMsk"
              UpdateOutputExamplesKinesis:
                $ref: "#/components/examples/UpdateOutputExamplesKinesis"
              UpdateOutputExamplesElastic:
                $ref: "#/components/examples/UpdateOutputExamplesElastic"
              UpdateOutputExamplesElasticCloud:
                $ref: "#/components/examples/UpdateOutputExamplesElasticCloud"
              UpdateOutputExamplesMicrosoftFabric:
                $ref: "#/components/examples/UpdateOutputExamplesMicrosoftFabric"
              UpdateOutputExamplesCloudflareR2:
                $ref: "#/components/examples/UpdateOutputExamplesCloudflareR2"
              UpdateOutputExamplesHoneycomb:
                $ref: "#/components/examples/UpdateOutputExamplesHoneycomb"
              UpdateOutputExamplesNewrelic:
                $ref: "#/components/examples/UpdateOutputExamplesNewrelic"
              UpdateOutputExamplesNewrelicEvents:
                $ref: "#/components/examples/UpdateOutputExamplesNewrelicEvents"
              UpdateOutputExamplesSnmp:
                $ref: "#/components/examples/UpdateOutputExamplesSnmp"
              UpdateOutputExamplesInfluxdb:
                $ref: "#/components/examples/UpdateOutputExamplesInfluxdb"
              UpdateOutputExamplesMinio:
                $ref: "#/components/examples/UpdateOutputExamplesMinio"
              UpdateOutputExamplesCloudwatch:
                $ref: "#/components/examples/UpdateOutputExamplesCloudwatch"
              UpdateOutputExamplesAzureEventhub:
                $ref: "#/components/examples/UpdateOutputExamplesAzureEventhub"
              UpdateOutputExamplesStatsd:
                $ref: "#/components/examples/UpdateOutputExamplesStatsd"
              UpdateOutputExamplesStatsdExt:
                $ref: "#/components/examples/UpdateOutputExamplesStatsdExt"
              UpdateOutputExamplesGraphite:
                $ref: "#/components/examples/UpdateOutputExamplesGraphite"
              UpdateOutputExamplesWavefront:
                $ref: "#/components/examples/UpdateOutputExamplesWavefront"
              UpdateOutputExamplesSignalfx:
                $ref: "#/components/examples/UpdateOutputExamplesSignalfx"
              UpdateOutputExamplesSqs:
                $ref: "#/components/examples/UpdateOutputExamplesSqs"
              UpdateOutputExamplesGoogleCloudStorage:
                $ref: "#/components/examples/UpdateOutputExamplesGoogleCloudStorage"
              UpdateOutputExamplesSumoLogic:
                $ref: "#/components/examples/UpdateOutputExamplesSumoLogic"
              UpdateOutputExamplesDatadog:
                $ref: "#/components/examples/UpdateOutputExamplesDatadog"
              UpdateOutputExamplesWebhook:
                $ref: "#/components/examples/UpdateOutputExamplesWebhook"
              UpdateOutputExamplesPrometheus:
                $ref: "#/components/examples/UpdateOutputExamplesPrometheus"
              UpdateOutputExamplesGooglePubsub:
                $ref: "#/components/examples/UpdateOutputExamplesGooglePubsub"
              UpdateOutputExamplesGoogleChronicle:
                $ref: "#/components/examples/UpdateOutputExamplesGoogleChronicle"
              UpdateOutputExamplesChronicle:
                $ref: "#/components/examples/UpdateOutputExamplesChronicle"
              UpdateOutputExamplesGrafanaCloud:
                $ref: "#/components/examples/UpdateOutputExamplesGrafanaCloud"
              UpdateOutputExamplesLoki:
                $ref: "#/components/examples/UpdateOutputExamplesLoki"
              UpdateOutputExamplesOpenTelemetry:
                $ref: "#/components/examples/UpdateOutputExamplesOpenTelemetry"
              UpdateOutputExamplesServiceNow:
                $ref: "#/components/examples/UpdateOutputExamplesServiceNow"
              UpdateOutputExamplesDynatraceOtlp:
                $ref: "#/components/examples/UpdateOutputExamplesDynatraceOtlp"
              UpdateOutputExamplesGoogleCloudObservability:
                $ref: "#/components/examples/UpdateOutputExamplesGoogleCloudObservability"
              UpdateOutputExamplesSentinelOneAiSiem:
                $ref: "#/components/examples/UpdateOutputExamplesSentinelOneAiSiem"
              UpdateOutputExamplesDataset:
                $ref: "#/components/examples/UpdateOutputExamplesDataset"
              UpdateOutputExamplesRing:
                $ref: "#/components/examples/UpdateOutputExamplesRing"
              UpdateOutputExamplesRouter:
                $ref: "#/components/examples/UpdateOutputExamplesRouter"
              UpdateOutputExamplesWizHec:
                $ref: "#/components/examples/UpdateOutputExamplesWizHec"
              UpdateOutputExamplesHumioHec:
                $ref: "#/components/examples/UpdateOutputExamplesHumioHec"
              UpdateOutputExamplesCrowdstrikeNextGenSiem:
                $ref: "#/components/examples/UpdateOutputExamplesCrowdstrikeNextGenSiem"
              UpdateOutputExamplesCriblHttp:
                $ref: "#/components/examples/UpdateOutputExamplesCriblHttp"
              UpdateOutputExamplesCriblTcp:
                $ref: "#/components/examples/UpdateOutputExamplesCriblTcp"
              UpdateOutputExamplesCriblSearchEngine:
                $ref: "#/components/examples/UpdateOutputExamplesCriblSearchEngine"
              UpdateOutputExamplesGoogleCloudLogging:
                $ref: "#/components/examples/UpdateOutputExamplesGoogleCloudLogging"
              UpdateOutputExamplesSns:
                $ref: "#/components/examples/UpdateOutputExamplesSns"
              UpdateOutputExamplesDlS3:
                $ref: "#/components/examples/UpdateOutputExamplesDlS3"
              UpdateOutputExamplesSecurityLake:
                $ref: "#/components/examples/UpdateOutputExamplesSecurityLake"
              UpdateOutputExamplesCriblLake:
                $ref: "#/components/examples/UpdateOutputExamplesCriblLake"
              UpdateOutputExamplesExabeam:
                $ref: "#/components/examples/UpdateOutputExamplesExabeam"
              UpdateOutputExamplesDiskSpool:
                $ref: "#/components/examples/UpdateOutputExamplesDiskSpool"
              UpdateOutputExamplesClickHouse:
                $ref: "#/components/examples/UpdateOutputExamplesClickHouse"
              UpdateOutputExamplesLocalSearchStorage:
                $ref: "#/components/examples/UpdateOutputExamplesLocalSearchStorage"
              UpdateOutputExamplesXsiam:
                $ref: "#/components/examples/UpdateOutputExamplesXsiam"
              UpdateOutputExamplesNetflow:
                $ref: "#/components/examples/UpdateOutputExamplesNetflow"
              UpdateOutputExamplesDynatraceHttp:
                $ref: "#/components/examples/UpdateOutputExamplesDynatraceHttp"
              UpdateOutputExamplesDatabricks:
                $ref: "#/components/examples/UpdateOutputExamplesDatabricks"
      responses:
        "200":
          description: the updated Destination object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteOutputSystemByPackAndId
      x-speakeasy-group: packs.destinations
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - destinations
      summary: Delete a Destination within a Pack
      description: Delete the specified Destination within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: the deleted Destination object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/system/outputs/{id}/pq:
    delete:
      operationId: deleteOutputSystemPqByPackAndId
      tags:
        - destinations
      x-speakeasy-group: packs.destinations.pq
      x-speakeasy-name-override: clear
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Clear the persistent queue for a Destination within a Pack
      description: Clear the persistent queue (PQ) for the specified Destination
        within the specified Pack.
      responses:
        "201":
          description: A list of job ids for the background job that clears the persistent
            queue
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to clear the PQ for.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getOutputSystemPqByPackAndId
      tags:
        - destinations
      x-speakeasy-group: packs.destinations.pq
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get information about the latest job to clear the persistent queue for
        a Destination within a Pack
      description: Get information about the latest job to clear the persistent queue
        (PQ) for the specified Destination within the specified Pack.
      responses:
        "200":
          description: information about the latest PQ clear job for the Destination
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedJobInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to get PQ job information for.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/outputs/{id}/samples:
    get:
      operationId: getOutputSystemSamplesByPackAndId
      tags:
        - destinations
      x-speakeasy-group: packs.destinations.samples
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get sample event data for a Destination within a Pack
      description: Get sample event data for the specified Destination to validate the
        configuration or test connectivity within the specified Pack.
      responses:
        "200":
          description: Sample event data for the Destination
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputSamplesResponse"
        "400":
          description: Bad Request — invalid request or Destination error
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to get sample event data for.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/outputs/{id}/test:
    post:
      operationId: createOutputSystemTestByPackAndId
      tags:
        - destinations
      x-speakeasy-group: packs.destinations.samples
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Send sample event data to a Destination within a Pack
      description: Send sample event data to the specified Destination to validate the
        configuration or test connectivity within the specified Pack.
      responses:
        "200":
          description: Destination test result
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputTestResponse"
        "400":
          description: Bad Request — missing or invalid events
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: OutputTestRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/OutputTestRequest"
            examples:
              OutputTestExamplesSingleEvent:
                $ref: "#/components/examples/OutputTestExamplesSingleEvent"
              OutputTestExamplesMultipleEvents:
                $ref: "#/components/examples/OutputTestExamplesMultipleEvents"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to send sample event data to.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /lib/parquet-schemas:
    get:
      operationId: listSchema
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - parquetschemas
      summary: Get a list of Schema objects
      description: Get a list of Schema objects.
      responses:
        "200":
          description: List of Schema objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createSchema
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - parquetschemas
      summary: Create a Parquet schema
      description: "Create a new Parquet schema.<br/><br/>NOTE: To create a JSON
        schema, use the <code>POST /lib/schemas</code> endpoint."
      requestBody:
        description: Schema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SchemaLibEntry"
            examples:
              ParquetSchemaExamplesEventData:
                $ref: "#/components/examples/ParquetSchemaExamplesEventData"
              ParquetSchemaExamplesAccessLogs:
                $ref: "#/components/examples/ParquetSchemaExamplesAccessLogs"
      responses:
        "200":
          description: The created Schema object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/parquet-schemas/{id}:
    get:
      operationId: getSchemaById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - parquetschemas
      summary: Get Schema by ID
      description: Get Schema by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Schema objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSchemaById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - parquetschemas
      summary: Update a Parquet schema
      description: "Update the specified Parquet Schema.<br/><br/>NOTE: To update a
        JSON schema, use the <code>PATCH /lib/schemas/{id}</code>
        endpoint.<br/><br/>Provide a complete representation of the Parquet
        schema that you want to update in the request body. This endpoint does
        not support partial updates. Cribl removes any omitted fields when
        updating the Parquet schema.<br/><br/>Confirm that the configuration in
        your request body is correct before sending the request. If the
        configuration is incorrect, the updated Parquet schema might not
        function as expected."
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Parquet schema to update.
      requestBody:
        description: Schema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SchemaLibEntry"
            examples:
              ParquetSchemaExamplesEventData:
                $ref: "#/components/examples/ParquetSchemaExamplesEventData"
              ParquetSchemaExamplesAccessLogs:
                $ref: "#/components/examples/ParquetSchemaExamplesAccessLogs"
      responses:
        "200":
          description: The updated Schema object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteSchemaById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - parquetschemas
      summary: Delete Schema
      description: Delete Schema.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted Schema object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /pipelines:
    post:
      operationId: createPipelines
      tags:
        - pipelines
      x-speakeasy-group: pipelines
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Pipeline
      description: Create a new Pipeline.
      responses:
        "200":
          description: a list of Pipelines objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: Pipeline object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Pipeline"
            examples:
              PipelineExamplesEmpty:
                $ref: "#/components/examples/PipelineExamplesEmpty"
              PipelineExamplesAggregations:
                $ref: "#/components/examples/PipelineExamplesAggregations"
              PipelineExamplesAggregateMetrics:
                $ref: "#/components/examples/PipelineExamplesAggregateMetrics"
              PipelineExamplesAutoTimestamp:
                $ref: "#/components/examples/PipelineExamplesAutoTimestamp"
              PipelineExamplesCEFSerializer:
                $ref: "#/components/examples/PipelineExamplesCEFSerializer"
              PipelineExamplesChain:
                $ref: "#/components/examples/PipelineExamplesChain"
              PipelineExamplesClone:
                $ref: "#/components/examples/PipelineExamplesClone"
              PipelineExamplesComment:
                $ref: "#/components/examples/PipelineExamplesComment"
              PipelineExamplesDNSLookup:
                $ref: "#/components/examples/PipelineExamplesDNSLookup"
              PipelineExamplesDrop:
                $ref: "#/components/examples/PipelineExamplesDrop"
              PipelineExamplesDropDimensions:
                $ref: "#/components/examples/PipelineExamplesDropDimensions"
              PipelineExamplesDynamicSampling:
                $ref: "#/components/examples/PipelineExamplesDynamicSampling"
              PipelineExamplesEval:
                $ref: "#/components/examples/PipelineExamplesEval"
              PipelineExamplesEventBreaker:
                $ref: "#/components/examples/PipelineExamplesEventBreaker"
              PipelineExamplesFlatten:
                $ref: "#/components/examples/PipelineExamplesFlatten"
              PipelineExamplesFoldKeys:
                $ref: "#/components/examples/PipelineExamplesFoldKeys"
              PipelineExamplesGeoIP:
                $ref: "#/components/examples/PipelineExamplesGeoIP"
              PipelineExamplesGrok:
                $ref: "#/components/examples/PipelineExamplesGrok"
              PipelineExamplesGuard:
                $ref: "#/components/examples/PipelineExamplesGuard"
              PipelineExamplesJSONUnroll:
                $ref: "#/components/examples/PipelineExamplesJSONUnroll"
              PipelineExamplesLookup:
                $ref: "#/components/examples/PipelineExamplesLookup"
              PipelineExamplesMask:
                $ref: "#/components/examples/PipelineExamplesMask"
              PipelineExamplesNumerify:
                $ref: "#/components/examples/PipelineExamplesNumerify"
              PipelineExamplesOTLPLogs:
                $ref: "#/components/examples/PipelineExamplesOTLPLogs"
              PipelineExamplesOTLPMetrics:
                $ref: "#/components/examples/PipelineExamplesOTLPMetrics"
              PipelineExamplesOTLPTraces:
                $ref: "#/components/examples/PipelineExamplesOTLPTraces"
              PipelineExamplesParser:
                $ref: "#/components/examples/PipelineExamplesParser"
              PipelineExamplesPublishMetrics:
                $ref: "#/components/examples/PipelineExamplesPublishMetrics"
              PipelineExamplesRedis:
                $ref: "#/components/examples/PipelineExamplesRedis"
              PipelineExamplesRegexExtract:
                $ref: "#/components/examples/PipelineExamplesRegexExtract"
              PipelineExamplesRegexFilter:
                $ref: "#/components/examples/PipelineExamplesRegexFilter"
              PipelineExamplesRename:
                $ref: "#/components/examples/PipelineExamplesRename"
              PipelineExamplesRollupMetrics:
                $ref: "#/components/examples/PipelineExamplesRollupMetrics"
              PipelineExamplesSampling:
                $ref: "#/components/examples/PipelineExamplesSampling"
              PipelineExamplesSerialize:
                $ref: "#/components/examples/PipelineExamplesSerialize"
              PipelineExamplesSNMPTrapSerialize:
                $ref: "#/components/examples/PipelineExamplesSNMPTrapSerialize"
              PipelineExamplesSuppress:
                $ref: "#/components/examples/PipelineExamplesSuppress"
              PipelineExamplesTee:
                $ref: "#/components/examples/PipelineExamplesTee"
              PipelineExamplesUnroll:
                $ref: "#/components/examples/PipelineExamplesUnroll"
              PipelineExamplesXMLUnroll:
                $ref: "#/components/examples/PipelineExamplesXMLUnroll"
    get:
      operationId: getPipelines
      tags:
        - pipelines
      x-speakeasy-group: pipelines
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Pipelines
      description: Get a list of all Pipelines.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /pipelines/{id}:
    delete:
      operationId: deletePipelinesById
      tags:
        - pipelines
      x-speakeasy-group: pipelines
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Pipeline
      description: Delete the specified Pipeline.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pipeline to delete.
    get:
      operationId: getPipelinesById
      tags:
        - pipelines
      x-speakeasy-group: pipelines
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Pipeline
      description: Get the specified Pipeline.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pipeline to get.
    patch:
      operationId: updatePipelinesById
      tags:
        - pipelines
      x-speakeasy-group: pipelines
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Pipeline
      description: Update the specified Pipeline.<br/><br/>Provide a complete
        representation of the Pipeline that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Pipeline.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Pipeline might
        not function as expected.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: Pipeline object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Pipeline"
            examples:
              UpdatePipelineExamplesEmpty:
                $ref: "#/components/examples/UpdatePipelineExamplesEmpty"
              UpdatePipelineExamplesAggregations:
                $ref: "#/components/examples/UpdatePipelineExamplesAggregations"
              UpdatePipelineExamplesAggregateMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesAggregateMetrics"
              UpdatePipelineExamplesAutoTimestamp:
                $ref: "#/components/examples/UpdatePipelineExamplesAutoTimestamp"
              UpdatePipelineExamplesCEFSerializer:
                $ref: "#/components/examples/UpdatePipelineExamplesCEFSerializer"
              UpdatePipelineExamplesChain:
                $ref: "#/components/examples/UpdatePipelineExamplesChain"
              UpdatePipelineExamplesClone:
                $ref: "#/components/examples/UpdatePipelineExamplesClone"
              UpdatePipelineExamplesComment:
                $ref: "#/components/examples/UpdatePipelineExamplesComment"
              UpdatePipelineExamplesDNSLookup:
                $ref: "#/components/examples/UpdatePipelineExamplesDNSLookup"
              UpdatePipelineExamplesDrop:
                $ref: "#/components/examples/UpdatePipelineExamplesDrop"
              UpdatePipelineExamplesDropDimensions:
                $ref: "#/components/examples/UpdatePipelineExamplesDropDimensions"
              UpdatePipelineExamplesDynamicSampling:
                $ref: "#/components/examples/UpdatePipelineExamplesDynamicSampling"
              UpdatePipelineExamplesEval:
                $ref: "#/components/examples/UpdatePipelineExamplesEval"
              UpdatePipelineExamplesEventBreaker:
                $ref: "#/components/examples/UpdatePipelineExamplesEventBreaker"
              UpdatePipelineExamplesFlatten:
                $ref: "#/components/examples/UpdatePipelineExamplesFlatten"
              UpdatePipelineExamplesFoldKeys:
                $ref: "#/components/examples/UpdatePipelineExamplesFoldKeys"
              UpdatePipelineExamplesGeoIP:
                $ref: "#/components/examples/UpdatePipelineExamplesGeoIP"
              UpdatePipelineExamplesGrok:
                $ref: "#/components/examples/UpdatePipelineExamplesGrok"
              UpdatePipelineExamplesGuard:
                $ref: "#/components/examples/UpdatePipelineExamplesGuard"
              UpdatePipelineExamplesJSONUnroll:
                $ref: "#/components/examples/UpdatePipelineExamplesJSONUnroll"
              UpdatePipelineExamplesLookup:
                $ref: "#/components/examples/UpdatePipelineExamplesLookup"
              UpdatePipelineExamplesMask:
                $ref: "#/components/examples/UpdatePipelineExamplesMask"
              UpdatePipelineExamplesNumerify:
                $ref: "#/components/examples/UpdatePipelineExamplesNumerify"
              UpdatePipelineExamplesOTLPLogs:
                $ref: "#/components/examples/UpdatePipelineExamplesOTLPLogs"
              UpdatePipelineExamplesOTLPMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesOTLPMetrics"
              UpdatePipelineExamplesOTLPTraces:
                $ref: "#/components/examples/UpdatePipelineExamplesOTLPTraces"
              UpdatePipelineExamplesParser:
                $ref: "#/components/examples/UpdatePipelineExamplesParser"
              UpdatePipelineExamplesPublishMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesPublishMetrics"
              UpdatePipelineExamplesRedis:
                $ref: "#/components/examples/UpdatePipelineExamplesRedis"
              UpdatePipelineExamplesRegexExtract:
                $ref: "#/components/examples/UpdatePipelineExamplesRegexExtract"
              UpdatePipelineExamplesRegexFilter:
                $ref: "#/components/examples/UpdatePipelineExamplesRegexFilter"
              UpdatePipelineExamplesRename:
                $ref: "#/components/examples/UpdatePipelineExamplesRename"
              UpdatePipelineExamplesRollupMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesRollupMetrics"
              UpdatePipelineExamplesSampling:
                $ref: "#/components/examples/UpdatePipelineExamplesSampling"
              UpdatePipelineExamplesSerialize:
                $ref: "#/components/examples/UpdatePipelineExamplesSerialize"
              UpdatePipelineExamplesSNMPTrapSerialize:
                $ref: "#/components/examples/UpdatePipelineExamplesSNMPTrapSerialize"
              UpdatePipelineExamplesSuppress:
                $ref: "#/components/examples/UpdatePipelineExamplesSuppress"
              UpdatePipelineExamplesTee:
                $ref: "#/components/examples/UpdatePipelineExamplesTee"
              UpdatePipelineExamplesUnroll:
                $ref: "#/components/examples/UpdatePipelineExamplesUnroll"
              UpdatePipelineExamplesXMLUnroll:
                $ref: "#/components/examples/UpdatePipelineExamplesXMLUnroll"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pipeline to update.
  /p/{pack}/pipelines:
    post:
      operationId: createPipelinesByPack
      tags:
        - pipelines
      x-speakeasy-group: packs.pipelines
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Pipeline within a Pack
      description: Create a new Pipeline within the specified Pack.
      responses:
        "200":
          description: a list of Pipelines objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: Pipeline object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Pipeline"
            examples:
              PipelineExamplesEmpty:
                $ref: "#/components/examples/PipelineExamplesEmpty"
              PipelineExamplesAggregations:
                $ref: "#/components/examples/PipelineExamplesAggregations"
              PipelineExamplesAggregateMetrics:
                $ref: "#/components/examples/PipelineExamplesAggregateMetrics"
              PipelineExamplesAutoTimestamp:
                $ref: "#/components/examples/PipelineExamplesAutoTimestamp"
              PipelineExamplesCEFSerializer:
                $ref: "#/components/examples/PipelineExamplesCEFSerializer"
              PipelineExamplesChain:
                $ref: "#/components/examples/PipelineExamplesChain"
              PipelineExamplesClone:
                $ref: "#/components/examples/PipelineExamplesClone"
              PipelineExamplesComment:
                $ref: "#/components/examples/PipelineExamplesComment"
              PipelineExamplesDNSLookup:
                $ref: "#/components/examples/PipelineExamplesDNSLookup"
              PipelineExamplesDrop:
                $ref: "#/components/examples/PipelineExamplesDrop"
              PipelineExamplesDropDimensions:
                $ref: "#/components/examples/PipelineExamplesDropDimensions"
              PipelineExamplesDynamicSampling:
                $ref: "#/components/examples/PipelineExamplesDynamicSampling"
              PipelineExamplesEval:
                $ref: "#/components/examples/PipelineExamplesEval"
              PipelineExamplesEventBreaker:
                $ref: "#/components/examples/PipelineExamplesEventBreaker"
              PipelineExamplesFlatten:
                $ref: "#/components/examples/PipelineExamplesFlatten"
              PipelineExamplesFoldKeys:
                $ref: "#/components/examples/PipelineExamplesFoldKeys"
              PipelineExamplesGeoIP:
                $ref: "#/components/examples/PipelineExamplesGeoIP"
              PipelineExamplesGrok:
                $ref: "#/components/examples/PipelineExamplesGrok"
              PipelineExamplesGuard:
                $ref: "#/components/examples/PipelineExamplesGuard"
              PipelineExamplesJSONUnroll:
                $ref: "#/components/examples/PipelineExamplesJSONUnroll"
              PipelineExamplesLookup:
                $ref: "#/components/examples/PipelineExamplesLookup"
              PipelineExamplesMask:
                $ref: "#/components/examples/PipelineExamplesMask"
              PipelineExamplesNumerify:
                $ref: "#/components/examples/PipelineExamplesNumerify"
              PipelineExamplesOTLPLogs:
                $ref: "#/components/examples/PipelineExamplesOTLPLogs"
              PipelineExamplesOTLPMetrics:
                $ref: "#/components/examples/PipelineExamplesOTLPMetrics"
              PipelineExamplesOTLPTraces:
                $ref: "#/components/examples/PipelineExamplesOTLPTraces"
              PipelineExamplesParser:
                $ref: "#/components/examples/PipelineExamplesParser"
              PipelineExamplesPublishMetrics:
                $ref: "#/components/examples/PipelineExamplesPublishMetrics"
              PipelineExamplesRedis:
                $ref: "#/components/examples/PipelineExamplesRedis"
              PipelineExamplesRegexExtract:
                $ref: "#/components/examples/PipelineExamplesRegexExtract"
              PipelineExamplesRegexFilter:
                $ref: "#/components/examples/PipelineExamplesRegexFilter"
              PipelineExamplesRename:
                $ref: "#/components/examples/PipelineExamplesRename"
              PipelineExamplesRollupMetrics:
                $ref: "#/components/examples/PipelineExamplesRollupMetrics"
              PipelineExamplesSampling:
                $ref: "#/components/examples/PipelineExamplesSampling"
              PipelineExamplesSerialize:
                $ref: "#/components/examples/PipelineExamplesSerialize"
              PipelineExamplesSNMPTrapSerialize:
                $ref: "#/components/examples/PipelineExamplesSNMPTrapSerialize"
              PipelineExamplesSuppress:
                $ref: "#/components/examples/PipelineExamplesSuppress"
              PipelineExamplesTee:
                $ref: "#/components/examples/PipelineExamplesTee"
              PipelineExamplesUnroll:
                $ref: "#/components/examples/PipelineExamplesUnroll"
              PipelineExamplesXMLUnroll:
                $ref: "#/components/examples/PipelineExamplesXMLUnroll"
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getPipelinesByPack
      tags:
        - pipelines
      x-speakeasy-group: packs.pipelines
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Pipelines within a Pack
      description: Get a list of all Pipelines within the specified Pack.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /system/projects/{projectId}/pipelines:
    post:
      operationId: createSystemProjectsPipelinesByProjectId
      tags:
        - pipelines
      x-speakeasy-group: projects.pipelines
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Pipeline within a Project
      description: Create a new Pipeline within the specified Project.
      responses:
        "200":
          description: a list of Pipelines objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: Pipeline object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Pipeline"
            examples:
              PipelineExamplesEmpty:
                $ref: "#/components/examples/PipelineExamplesEmpty"
              PipelineExamplesAggregations:
                $ref: "#/components/examples/PipelineExamplesAggregations"
              PipelineExamplesAggregateMetrics:
                $ref: "#/components/examples/PipelineExamplesAggregateMetrics"
              PipelineExamplesAutoTimestamp:
                $ref: "#/components/examples/PipelineExamplesAutoTimestamp"
              PipelineExamplesCEFSerializer:
                $ref: "#/components/examples/PipelineExamplesCEFSerializer"
              PipelineExamplesChain:
                $ref: "#/components/examples/PipelineExamplesChain"
              PipelineExamplesClone:
                $ref: "#/components/examples/PipelineExamplesClone"
              PipelineExamplesComment:
                $ref: "#/components/examples/PipelineExamplesComment"
              PipelineExamplesDNSLookup:
                $ref: "#/components/examples/PipelineExamplesDNSLookup"
              PipelineExamplesDrop:
                $ref: "#/components/examples/PipelineExamplesDrop"
              PipelineExamplesDropDimensions:
                $ref: "#/components/examples/PipelineExamplesDropDimensions"
              PipelineExamplesDynamicSampling:
                $ref: "#/components/examples/PipelineExamplesDynamicSampling"
              PipelineExamplesEval:
                $ref: "#/components/examples/PipelineExamplesEval"
              PipelineExamplesEventBreaker:
                $ref: "#/components/examples/PipelineExamplesEventBreaker"
              PipelineExamplesFlatten:
                $ref: "#/components/examples/PipelineExamplesFlatten"
              PipelineExamplesFoldKeys:
                $ref: "#/components/examples/PipelineExamplesFoldKeys"
              PipelineExamplesGeoIP:
                $ref: "#/components/examples/PipelineExamplesGeoIP"
              PipelineExamplesGrok:
                $ref: "#/components/examples/PipelineExamplesGrok"
              PipelineExamplesGuard:
                $ref: "#/components/examples/PipelineExamplesGuard"
              PipelineExamplesJSONUnroll:
                $ref: "#/components/examples/PipelineExamplesJSONUnroll"
              PipelineExamplesLookup:
                $ref: "#/components/examples/PipelineExamplesLookup"
              PipelineExamplesMask:
                $ref: "#/components/examples/PipelineExamplesMask"
              PipelineExamplesNumerify:
                $ref: "#/components/examples/PipelineExamplesNumerify"
              PipelineExamplesOTLPLogs:
                $ref: "#/components/examples/PipelineExamplesOTLPLogs"
              PipelineExamplesOTLPMetrics:
                $ref: "#/components/examples/PipelineExamplesOTLPMetrics"
              PipelineExamplesOTLPTraces:
                $ref: "#/components/examples/PipelineExamplesOTLPTraces"
              PipelineExamplesParser:
                $ref: "#/components/examples/PipelineExamplesParser"
              PipelineExamplesPublishMetrics:
                $ref: "#/components/examples/PipelineExamplesPublishMetrics"
              PipelineExamplesRedis:
                $ref: "#/components/examples/PipelineExamplesRedis"
              PipelineExamplesRegexExtract:
                $ref: "#/components/examples/PipelineExamplesRegexExtract"
              PipelineExamplesRegexFilter:
                $ref: "#/components/examples/PipelineExamplesRegexFilter"
              PipelineExamplesRename:
                $ref: "#/components/examples/PipelineExamplesRename"
              PipelineExamplesRollupMetrics:
                $ref: "#/components/examples/PipelineExamplesRollupMetrics"
              PipelineExamplesSampling:
                $ref: "#/components/examples/PipelineExamplesSampling"
              PipelineExamplesSerialize:
                $ref: "#/components/examples/PipelineExamplesSerialize"
              PipelineExamplesSNMPTrapSerialize:
                $ref: "#/components/examples/PipelineExamplesSNMPTrapSerialize"
              PipelineExamplesSuppress:
                $ref: "#/components/examples/PipelineExamplesSuppress"
              PipelineExamplesTee:
                $ref: "#/components/examples/PipelineExamplesTee"
              PipelineExamplesUnroll:
                $ref: "#/components/examples/PipelineExamplesUnroll"
              PipelineExamplesXMLUnroll:
                $ref: "#/components/examples/PipelineExamplesXMLUnroll"
      parameters:
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Project.
      deprecated: true
    get:
      operationId: getSystemProjectsPipelinesByProjectId
      tags:
        - pipelines
      x-speakeasy-group: projects.pipelines
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Pipelines within a Project
      description: Get a list of all Pipelines within the specified Project.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Project.
      deprecated: true
  /p/{pack}/pipelines/{id}:
    delete:
      operationId: deletePipelinesByPackAndId
      tags:
        - pipelines
      x-speakeasy-group: packs.pipelines
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Pipeline within a Pack
      description: Delete the specified Pipeline within the specified Pack.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pipeline to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getPipelinesByPackAndId
      tags:
        - pipelines
      x-speakeasy-group: packs.pipelines
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Pipeline within a Pack
      description: Get the specified Pipeline within the specified Pack.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pipeline to get.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    patch:
      operationId: updatePipelinesByPackAndId
      tags:
        - pipelines
      x-speakeasy-group: packs.pipelines
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Pipeline within a Pack
      description: Update the specified Pipeline within the specified
        Pack.<br/><br/>Provide a complete representation of the Pipeline that
        you want to update in the request body. This endpoint does not support
        partial updates. Cribl removes any omitted fields when updating the
        Pipeline.<br/><br/>Confirm that the configuration in your request body
        is correct before sending the request. If the configuration is
        incorrect, the updated Pipeline might not function as expected.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: Pipeline object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Pipeline"
            examples:
              UpdatePipelineExamplesEmpty:
                $ref: "#/components/examples/UpdatePipelineExamplesEmpty"
              UpdatePipelineExamplesAggregations:
                $ref: "#/components/examples/UpdatePipelineExamplesAggregations"
              UpdatePipelineExamplesAggregateMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesAggregateMetrics"
              UpdatePipelineExamplesAutoTimestamp:
                $ref: "#/components/examples/UpdatePipelineExamplesAutoTimestamp"
              UpdatePipelineExamplesCEFSerializer:
                $ref: "#/components/examples/UpdatePipelineExamplesCEFSerializer"
              UpdatePipelineExamplesChain:
                $ref: "#/components/examples/UpdatePipelineExamplesChain"
              UpdatePipelineExamplesClone:
                $ref: "#/components/examples/UpdatePipelineExamplesClone"
              UpdatePipelineExamplesComment:
                $ref: "#/components/examples/UpdatePipelineExamplesComment"
              UpdatePipelineExamplesDNSLookup:
                $ref: "#/components/examples/UpdatePipelineExamplesDNSLookup"
              UpdatePipelineExamplesDrop:
                $ref: "#/components/examples/UpdatePipelineExamplesDrop"
              UpdatePipelineExamplesDropDimensions:
                $ref: "#/components/examples/UpdatePipelineExamplesDropDimensions"
              UpdatePipelineExamplesDynamicSampling:
                $ref: "#/components/examples/UpdatePipelineExamplesDynamicSampling"
              UpdatePipelineExamplesEval:
                $ref: "#/components/examples/UpdatePipelineExamplesEval"
              UpdatePipelineExamplesEventBreaker:
                $ref: "#/components/examples/UpdatePipelineExamplesEventBreaker"
              UpdatePipelineExamplesFlatten:
                $ref: "#/components/examples/UpdatePipelineExamplesFlatten"
              UpdatePipelineExamplesFoldKeys:
                $ref: "#/components/examples/UpdatePipelineExamplesFoldKeys"
              UpdatePipelineExamplesGeoIP:
                $ref: "#/components/examples/UpdatePipelineExamplesGeoIP"
              UpdatePipelineExamplesGrok:
                $ref: "#/components/examples/UpdatePipelineExamplesGrok"
              UpdatePipelineExamplesGuard:
                $ref: "#/components/examples/UpdatePipelineExamplesGuard"
              UpdatePipelineExamplesJSONUnroll:
                $ref: "#/components/examples/UpdatePipelineExamplesJSONUnroll"
              UpdatePipelineExamplesLookup:
                $ref: "#/components/examples/UpdatePipelineExamplesLookup"
              UpdatePipelineExamplesMask:
                $ref: "#/components/examples/UpdatePipelineExamplesMask"
              UpdatePipelineExamplesNumerify:
                $ref: "#/components/examples/UpdatePipelineExamplesNumerify"
              UpdatePipelineExamplesOTLPLogs:
                $ref: "#/components/examples/UpdatePipelineExamplesOTLPLogs"
              UpdatePipelineExamplesOTLPMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesOTLPMetrics"
              UpdatePipelineExamplesOTLPTraces:
                $ref: "#/components/examples/UpdatePipelineExamplesOTLPTraces"
              UpdatePipelineExamplesParser:
                $ref: "#/components/examples/UpdatePipelineExamplesParser"
              UpdatePipelineExamplesPublishMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesPublishMetrics"
              UpdatePipelineExamplesRedis:
                $ref: "#/components/examples/UpdatePipelineExamplesRedis"
              UpdatePipelineExamplesRegexExtract:
                $ref: "#/components/examples/UpdatePipelineExamplesRegexExtract"
              UpdatePipelineExamplesRegexFilter:
                $ref: "#/components/examples/UpdatePipelineExamplesRegexFilter"
              UpdatePipelineExamplesRename:
                $ref: "#/components/examples/UpdatePipelineExamplesRename"
              UpdatePipelineExamplesRollupMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesRollupMetrics"
              UpdatePipelineExamplesSampling:
                $ref: "#/components/examples/UpdatePipelineExamplesSampling"
              UpdatePipelineExamplesSerialize:
                $ref: "#/components/examples/UpdatePipelineExamplesSerialize"
              UpdatePipelineExamplesSNMPTrapSerialize:
                $ref: "#/components/examples/UpdatePipelineExamplesSNMPTrapSerialize"
              UpdatePipelineExamplesSuppress:
                $ref: "#/components/examples/UpdatePipelineExamplesSuppress"
              UpdatePipelineExamplesTee:
                $ref: "#/components/examples/UpdatePipelineExamplesTee"
              UpdatePipelineExamplesUnroll:
                $ref: "#/components/examples/UpdatePipelineExamplesUnroll"
              UpdatePipelineExamplesXMLUnroll:
                $ref: "#/components/examples/UpdatePipelineExamplesXMLUnroll"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pipeline to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /system/projects/{projectId}/pipelines/{id}:
    delete:
      operationId: deleteSystemProjectsPipelinesByProjectIdAndId
      tags:
        - pipelines
      x-speakeasy-group: projects.pipelines
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Pipeline within a Project
      description: Delete the specified Pipeline within the specified Project.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pipeline to delete.
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Project.
      deprecated: true
    get:
      operationId: getSystemProjectsPipelinesByProjectIdAndId
      tags:
        - pipelines
      x-speakeasy-group: projects.pipelines
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Pipeline within a Project
      description: Get the specified Pipeline within the specified Project.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pipeline to get.
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Project.
      deprecated: true
    patch:
      operationId: updateSystemProjectsPipelinesByProjectIdAndId
      tags:
        - pipelines
      x-speakeasy-group: projects.pipelines
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Pipeline within a Project
      description: Update the specified Pipeline within the specified
        Project.<br/><br/>Provide a complete representation of the Pipeline that
        you want to update in the request body. This endpoint does not support
        partial updates. Cribl removes any omitted fields when updating the
        Pipeline.<br/><br/>Confirm that the configuration in your request body
        is correct before sending the request. If the configuration is
        incorrect, the updated Pipeline might not function as expected.
      responses:
        "200":
          description: a list of Pipeline objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPipeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: Pipeline object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Pipeline"
            examples:
              UpdatePipelineExamplesEmpty:
                $ref: "#/components/examples/UpdatePipelineExamplesEmpty"
              UpdatePipelineExamplesAggregations:
                $ref: "#/components/examples/UpdatePipelineExamplesAggregations"
              UpdatePipelineExamplesAggregateMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesAggregateMetrics"
              UpdatePipelineExamplesAutoTimestamp:
                $ref: "#/components/examples/UpdatePipelineExamplesAutoTimestamp"
              UpdatePipelineExamplesCEFSerializer:
                $ref: "#/components/examples/UpdatePipelineExamplesCEFSerializer"
              UpdatePipelineExamplesChain:
                $ref: "#/components/examples/UpdatePipelineExamplesChain"
              UpdatePipelineExamplesClone:
                $ref: "#/components/examples/UpdatePipelineExamplesClone"
              UpdatePipelineExamplesComment:
                $ref: "#/components/examples/UpdatePipelineExamplesComment"
              UpdatePipelineExamplesDNSLookup:
                $ref: "#/components/examples/UpdatePipelineExamplesDNSLookup"
              UpdatePipelineExamplesDrop:
                $ref: "#/components/examples/UpdatePipelineExamplesDrop"
              UpdatePipelineExamplesDropDimensions:
                $ref: "#/components/examples/UpdatePipelineExamplesDropDimensions"
              UpdatePipelineExamplesDynamicSampling:
                $ref: "#/components/examples/UpdatePipelineExamplesDynamicSampling"
              UpdatePipelineExamplesEval:
                $ref: "#/components/examples/UpdatePipelineExamplesEval"
              UpdatePipelineExamplesEventBreaker:
                $ref: "#/components/examples/UpdatePipelineExamplesEventBreaker"
              UpdatePipelineExamplesFlatten:
                $ref: "#/components/examples/UpdatePipelineExamplesFlatten"
              UpdatePipelineExamplesFoldKeys:
                $ref: "#/components/examples/UpdatePipelineExamplesFoldKeys"
              UpdatePipelineExamplesGeoIP:
                $ref: "#/components/examples/UpdatePipelineExamplesGeoIP"
              UpdatePipelineExamplesGrok:
                $ref: "#/components/examples/UpdatePipelineExamplesGrok"
              UpdatePipelineExamplesGuard:
                $ref: "#/components/examples/UpdatePipelineExamplesGuard"
              UpdatePipelineExamplesJSONUnroll:
                $ref: "#/components/examples/UpdatePipelineExamplesJSONUnroll"
              UpdatePipelineExamplesLookup:
                $ref: "#/components/examples/UpdatePipelineExamplesLookup"
              UpdatePipelineExamplesMask:
                $ref: "#/components/examples/UpdatePipelineExamplesMask"
              UpdatePipelineExamplesNumerify:
                $ref: "#/components/examples/UpdatePipelineExamplesNumerify"
              UpdatePipelineExamplesOTLPLogs:
                $ref: "#/components/examples/UpdatePipelineExamplesOTLPLogs"
              UpdatePipelineExamplesOTLPMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesOTLPMetrics"
              UpdatePipelineExamplesOTLPTraces:
                $ref: "#/components/examples/UpdatePipelineExamplesOTLPTraces"
              UpdatePipelineExamplesParser:
                $ref: "#/components/examples/UpdatePipelineExamplesParser"
              UpdatePipelineExamplesPublishMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesPublishMetrics"
              UpdatePipelineExamplesRedis:
                $ref: "#/components/examples/UpdatePipelineExamplesRedis"
              UpdatePipelineExamplesRegexExtract:
                $ref: "#/components/examples/UpdatePipelineExamplesRegexExtract"
              UpdatePipelineExamplesRegexFilter:
                $ref: "#/components/examples/UpdatePipelineExamplesRegexFilter"
              UpdatePipelineExamplesRename:
                $ref: "#/components/examples/UpdatePipelineExamplesRename"
              UpdatePipelineExamplesRollupMetrics:
                $ref: "#/components/examples/UpdatePipelineExamplesRollupMetrics"
              UpdatePipelineExamplesSampling:
                $ref: "#/components/examples/UpdatePipelineExamplesSampling"
              UpdatePipelineExamplesSerialize:
                $ref: "#/components/examples/UpdatePipelineExamplesSerialize"
              UpdatePipelineExamplesSNMPTrapSerialize:
                $ref: "#/components/examples/UpdatePipelineExamplesSNMPTrapSerialize"
              UpdatePipelineExamplesSuppress:
                $ref: "#/components/examples/UpdatePipelineExamplesSuppress"
              UpdatePipelineExamplesTee:
                $ref: "#/components/examples/UpdatePipelineExamplesTee"
              UpdatePipelineExamplesUnroll:
                $ref: "#/components/examples/UpdatePipelineExamplesUnroll"
              UpdatePipelineExamplesXMLUnroll:
                $ref: "#/components/examples/UpdatePipelineExamplesXMLUnroll"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pipeline to update.
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Project.
      deprecated: true
  /system/profiler:
    post:
      operationId: createProfilerItem
      tags:
        - profiler
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Profiler capture
      description: Create a new Profiler capture for the process specified in the
        request body.
      responses:
        "200":
          description: the created Profiler capture object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProfilerItem"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ProfilerItem object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProfilerItem"
            examples:
              CreateProfilerExamplesProfileWorker:
                $ref: "#/components/examples/CreateProfilerExamplesProfileWorker"
    get:
      operationId: getProfilerItem
      tags:
        - profiler
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Profiler captures
      description: Get a list of all Profiler captures.
      responses:
        "200":
          description: a list of Profiler capture objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProfilerItem"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/profiler/{id}:
    delete:
      operationId: deleteProfilerItemById
      tags:
        - profiler
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Profiler capture
      description: Delete the specified Profiler capture.
      responses:
        "200":
          description: the deleted Profiler capture object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProfilerItem"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Profiler capture to delete.
    get:
      operationId: getProfilerItemById
      tags:
        - profiler
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Profiler capture
      description: Get the specified Profiler capture.
      responses:
        "200":
          description: a Profiler capture object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProfilerItem"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Profiler capture to get.
  /routes/{id}:
    get:
      operationId: getRoutesById
      tags:
        - routes
      x-speakeasy-group: routes
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Routing table
      description: Get the specified Routing table.
      responses:
        "200":
          description: a list of Routes objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRoutes"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Routing table to get. The supported
            value is <code>default</code>.
    patch:
      operationId: updateRoutesById
      tags:
        - routes
      x-speakeasy-group: routes
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Route
      description: Update a Route in the specified Routing table.<br/><br/>\1 This
        endpoint does not support partial updates. Cribl removes any omitted
        fields when updating the Routing table.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Routing table
        might not function as expected.<br/><br/>Cribl also removes any omitted
        Routes when updating the Routing table.
      responses:
        "200":
          description: a list of Routes objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRoutes"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: RoutesInput object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RoutesInput"
            examples:
              RoutesUpdateExamplesBasicRoute:
                $ref: "#/components/examples/RoutesUpdateExamplesBasicRoute"
              RoutesUpdateExamplesMultipleRoutes:
                $ref: "#/components/examples/RoutesUpdateExamplesMultipleRoutes"
              RoutesUpdateExamplesRouteWithOutputExpression:
                $ref: "#/components/examples/RoutesUpdateExamplesRouteWithOutputExpression"
              RoutesUpdateExamplesRouteWithDefaults:
                $ref: "#/components/examples/RoutesUpdateExamplesRouteWithDefaults"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Routing table that contains the Route to
            update. The supported value is <code>default</code>.
  /routes:
    get:
      operationId: getRoutes
      tags:
        - routes
      x-speakeasy-group: routes
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Routes
      description: Get a list of all Routes.
      responses:
        "200":
          description: a list of Routes objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRoutes"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /routes/{id}/append:
    post:
      operationId: createRoutesAppendById
      tags:
        - routes
      x-speakeasy-group: routes
      x-speakeasy-name-override: append
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Add a Route to the end of the Routing table
      description: Add a Route to the end of the specified Routing table.
      responses:
        "200":
          description: The created Routes object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRoutes"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: RouteDefinitions object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RouteDefinitions"
            examples:
              RoutesAppendExamplesSingleRoute:
                $ref: "#/components/examples/RoutesAppendExamplesSingleRoute"
              RoutesAppendExamplesMultipleRoutes:
                $ref: "#/components/examples/RoutesAppendExamplesMultipleRoutes"
              RoutesAppendExamplesRouteWithOutputExpression:
                $ref: "#/components/examples/RoutesAppendExamplesRouteWithOutputExpression"
              RoutesAppendExamplesRouteWithDefaults:
                $ref: "#/components/examples/RoutesAppendExamplesRouteWithDefaults"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Routing table to add the Route to. The
            supported value is <code>default</code>.
  /p/{pack}/routes/{id}:
    get:
      operationId: getRoutesByPackAndId
      tags:
        - routes
      x-speakeasy-group: packs.routes
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Routing table within a Pack
      description: Get the specified Routing table within the specified Pack.
      responses:
        "200":
          description: a list of Routes objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRoutes"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Routing table to get. The supported
            value is <code>default</code>.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    patch:
      operationId: updateRoutesByPackAndId
      tags:
        - routes
      x-speakeasy-group: packs.routes
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Route within a Pack
      description: Update the specified Route within the specified
        Pack.<br/><br/>Provide a complete representation of the Routing table,
        including the Route that you want to update, in the request
        body.<br/><br/>This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Routing
        table.<br/><br/>Confirm that the configuration in your request body is
        correct before sending the request. If the configuration is incorrect,
        the updated Routing table might not function as expected.<br/><br/>Cribl
        also removes any omitted Routes when updating the Routing table.
      responses:
        "200":
          description: a list of Routes objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRoutes"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: RoutesInput object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RoutesInput"
            examples:
              RoutesUpdateExamplesBasicRoute:
                $ref: "#/components/examples/RoutesUpdateExamplesBasicRoute"
              RoutesUpdateExamplesMultipleRoutes:
                $ref: "#/components/examples/RoutesUpdateExamplesMultipleRoutes"
              RoutesUpdateExamplesRouteWithOutputExpression:
                $ref: "#/components/examples/RoutesUpdateExamplesRouteWithOutputExpression"
              RoutesUpdateExamplesRouteWithDefaults:
                $ref: "#/components/examples/RoutesUpdateExamplesRouteWithDefaults"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Routing table that contains the Route to
            update. The supported value is <code>default</code>.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/routes:
    get:
      operationId: getRoutesByPack
      tags:
        - routes
      x-speakeasy-group: packs.routes
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Routes within a Pack
      description: Get a list of all Routes within the specified Pack.
      responses:
        "200":
          description: a list of Routes objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRoutes"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/routes/{id}/append:
    post:
      operationId: createRoutesAppendByPackAndId
      tags:
        - routes
      x-speakeasy-group: packs.routes
      x-speakeasy-name-override: append
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Add a Route to the end of the Routing table within a Pack
      description: Add a Route to the end of the specified Routing table within the
        specified Pack.
      responses:
        "200":
          description: The created Routes object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRoutes"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: RouteDefinitions object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RouteDefinitions"
            examples:
              RoutesAppendExamplesSingleRoute:
                $ref: "#/components/examples/RoutesAppendExamplesSingleRoute"
              RoutesAppendExamplesMultipleRoutes:
                $ref: "#/components/examples/RoutesAppendExamplesMultipleRoutes"
              RoutesAppendExamplesRouteWithOutputExpression:
                $ref: "#/components/examples/RoutesAppendExamplesRouteWithOutputExpression"
              RoutesAppendExamplesRouteWithDefaults:
                $ref: "#/components/examples/RoutesAppendExamplesRouteWithDefaults"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Routing table to add the Route to. The
            supported value is <code>default</code>.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /lib/schemas:
    get:
      operationId: listLibSchemas
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - schemas
      summary: Get a list of Schema objects
      description: Get a list of Schema objects.
      responses:
        "200":
          description: List of Schema objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createLibSchemas
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - schemas
      summary: Create a JSON schema
      description: "Create a new JSON schema.<br/><br/>NOTE: To create a Parquet
        schema, use the <code>POST /lib/parquet-schemas</code> endpoint."
      requestBody:
        description: Schema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SchemaLibEntry"
            examples:
              SchemaExamplesEventData:
                $ref: "#/components/examples/SchemaExamplesEventData"
              SchemaExamplesUserActivity:
                $ref: "#/components/examples/SchemaExamplesUserActivity"
      responses:
        "200":
          description: The created Schema object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/schemas/{id}:
    get:
      operationId: getLibSchemasById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - schemas
      summary: Get Schema by ID
      description: Get Schema by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Schema objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateLibSchemasById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - schemas
      summary: Update a JSON schema
      description: "Update the specified JSON schema.<br/><br/>NOTE: To update a
        Parquet schema, use the <code>PATCH /lib/parquet-schemas/{id}</code>
        endpoint.<br/><br/>Provide a complete representation of the JSON schema
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the JSON schema.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated JSON schema might not function as expected."
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the JSON schema to update.
      requestBody:
        description: Schema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SchemaLibEntry"
            examples:
              SchemaExamplesEventData:
                $ref: "#/components/examples/SchemaExamplesEventData"
              SchemaExamplesUserActivity:
                $ref: "#/components/examples/SchemaExamplesUserActivity"
      responses:
        "200":
          description: The updated Schema object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteLibSchemasById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - schemas
      summary: Delete Schema
      description: Delete Schema.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted Schema object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/lib/schemas:
    get:
      operationId: getSchemaLibByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - schemas
      summary: Get a list of Schema objects within a Pack
      description: Get a list of Schema objects within the specified Pack.
      responses:
        "200":
          description: List of Schema objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.schemas
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    post:
      operationId: createSchemaLibByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - schemas
      summary: Create a JSON schema within a Pack
      description: "Create a new JSON schema.<br/><br/>NOTE: To create a Parquet
        schema, use the <code>POST /lib/parquet-schemas</code> endpoint within
        the specified Pack."
      requestBody:
        description: Schema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SchemaLibEntry"
            examples:
              SchemaExamplesEventData:
                $ref: "#/components/examples/SchemaExamplesEventData"
              SchemaExamplesUserActivity:
                $ref: "#/components/examples/SchemaExamplesUserActivity"
      responses:
        "200":
          description: The created Schema object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.schemas
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/lib/schemas/{id}:
    get:
      operationId: getSchemaLibByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - schemas
      summary: Get Schema by ID within a Pack
      description: Get Schema by ID within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: List of Schema objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.schemas
    patch:
      operationId: updateSchemaLibByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - schemas
      summary: Update a JSON schema within a Pack
      description: "Update the specified JSON schema.<br/><br/>NOTE: To update a
        Parquet schema, use the <code>PATCH /lib/parquet-schemas/{id}</code>
        endpoint.<br/><br/>Provide a complete representation of the JSON schema
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the JSON schema.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated JSON schema might not function as expected within
        the specified Pack."
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the JSON schema to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: Schema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SchemaLibEntry"
            examples:
              SchemaExamplesEventData:
                $ref: "#/components/examples/SchemaExamplesEventData"
              SchemaExamplesUserActivity:
                $ref: "#/components/examples/SchemaExamplesUserActivity"
      responses:
        "200":
          description: The updated Schema object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.schemas
    delete:
      operationId: deleteSchemaLibByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - schemas
      summary: Delete Schema within a Pack
      description: Delete Schema within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: The deleted Schema object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSchemaLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.schemas
  /system/secrets:
    post:
      operationId: createRestSecret
      tags:
        - secrets
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a secret
      description: Create a new secret.
      responses:
        "200":
          description: The created RestSecret object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRestSecret"
        "400":
          description: Bad Request — invalid request body or validation error
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "409":
          description: Conflict — Secret with the same <code>id</code> already exists
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: RestSecret object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RestSecret"
            examples:
              CreateSecretExamplesTextSecret:
                $ref: "#/components/examples/CreateSecretExamplesTextSecret"
              CreateSecretExamplesCredentialSecret:
                $ref: "#/components/examples/CreateSecretExamplesCredentialSecret"
              CreateSecretExamplesKeypairSecret:
                $ref: "#/components/examples/CreateSecretExamplesKeypairSecret"
    get:
      operationId: getRestSecret
      tags:
        - secrets
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all secrets
      description: Get a list of all secrets.
      responses:
        "200":
          description: List of RestSecret objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRestSecret"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/SecretType"
          description: Filter by secret type.
  /system/secrets/{id}:
    delete:
      operationId: deleteRestSecretById
      tags:
        - secrets
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a secret
      description: Delete the specified secret.
      responses:
        "200":
          description: The deleted RestSecret object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRestSecret"
        "400":
          description: Bad Request — Secret is in use by other configurations
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Secret not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret to delete.
    get:
      operationId: getRestSecretById
      tags:
        - secrets
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a secret
      description: Get the specified secret.
      responses:
        "200":
          description: List of RestSecret objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRestSecret"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Secret not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret to get.
        - name: folderId
          in: query
          required: false
          schema:
            type: string
          description: When provided, returns the shared global secret from the specified
            folder whose <code>id</code> matches the path parameter.
    patch:
      operationId: updateRestSecretById
      tags:
        - secrets
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a secret
      description: Update the specified secret.<br/><br/>Provide a complete
        representation of the secret that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the secret.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated secret might not
        function as expected.
      responses:
        "200":
          description: The updated RestSecret object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRestSecret"
        "400":
          description: Bad Request — invalid request body or validation error
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Secret not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: RestSecret object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RestSecret"
            examples:
              UpdateSecretExamplesUpdateTextSecret:
                $ref: "#/components/examples/UpdateSecretExamplesUpdateTextSecret"
              UpdateSecretExamplesUpdateKeypairSecret:
                $ref: "#/components/examples/UpdateSecretExamplesUpdateKeypairSecret"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret to update.
  /system/secrets/{id}/refs:
    get:
      operationId: getRestSecretRefsById
      tags:
        - secrets
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List references to a secret
      description: Get a list of the entities that reference the specified secret.
      responses:
        "200":
          description: List of ReferencedEntity objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedReferencedEntity"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret.
  /system/status/inputs/{id}:
    get:
      operationId: getInputStatusById
      tags:
        - sources
      x-speakeasy-group: sources.statuses
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the status of a Source
      description: Get the status and optional metrics for the specified Source.
      responses:
        "200":
          description: a Source status object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputStatus"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to get the status for.
        - name: metrics
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include metrics for each Source.
            Otherwise, <code>false</code> (default).
        - name: type
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to prefix the Source <code>id</code> with
            the Source type. Otherwise, <code>false</code> (default).
  /system/status/inputs:
    get:
      operationId: getInputStatus
      tags:
        - sources
      x-speakeasy-group: sources.statuses
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List the status of all Sources
      description: List status information and optional metrics for all configured
        Sources in the Worker Group or Edge Fleet.
      responses:
        "200":
          description: a list of Source status objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputStatus"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: metrics
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include metrics for each Source.
            Otherwise, <code>false</code> (default).
        - name: type
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to prefix the Source <code>id</code> with
            the Source type. Otherwise, <code>false</code> (default).
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of items to return in the response for this request.
            Use with <code>offset</code> to paginate the response into
            manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /p/{pack}/system/status/inputs/{id}:
    get:
      operationId: getInputStatusSystemInputsByPackAndId
      tags:
        - sources
      x-speakeasy-group: packs.sources.statuses
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the status of a Source within a Pack
      description: Get the status and optional metrics for the specified Source within
        the specified Pack.
      responses:
        "200":
          description: a Source status object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputStatus"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Source to get the status for.
        - name: metrics
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include metrics for each Source.
            Otherwise, <code>false</code> (default).
        - name: type
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to prefix the Source <code>id</code> with
            the Source type. Otherwise, <code>false</code> (default).
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/status/inputs:
    get:
      operationId: getInputStatusSystemInputsByPack
      tags:
        - sources
      x-speakeasy-group: packs.sources.statuses
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List the status of all Sources within a Pack
      description: List status information and optional metrics for all configured
        Sources in the Worker Group or Edge Fleet within the specified Pack.
      responses:
        "200":
          description: a list of Source status objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInputStatus"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: metrics
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include metrics for each Source.
            Otherwise, <code>false</code> (default).
        - name: type
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to prefix the Source <code>id</code> with
            the Source type. Otherwise, <code>false</code> (default).
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of items to return in the response for this request.
            Use with <code>offset</code> to paginate the response into
            manageable batches.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /system/status/outputs/{id}:
    get:
      operationId: getOutputStatusById
      tags:
        - destinations
      x-speakeasy-group: destinations.statuses
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the status of a Destination
      description: Get the status and optional metrics for the specified Destination.
      responses:
        "200":
          description: Destination status object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputStatus"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to get the status for.
        - name: metrics
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include metrics for each Destination.
            Otherwise, <code>false</code> (default).
        - name: type
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to prefix the Destination <code>id</code>
            with the Destination type. Otherwise, <code>false</code> (default).
  /system/status/outputs:
    get:
      operationId: getOutputStatus
      tags:
        - destinations
      x-speakeasy-group: destinations.statuses
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List the status of all Destinations
      description: List status information and optional metrics for all configured
        Destinations in the Worker Group or Edge Fleet.
      responses:
        "200":
          description: a list of Destination status objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputStatus"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: metrics
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include metrics for each Destination.
            Otherwise, <code>false</code> (default).
        - name: type
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to prefix the Destination <code>id</code>
            with the Destination type. Otherwise, <code>false</code> (default).
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of items to return in the response for this request.
            Use with <code>offset</code> to paginate the response into
            manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /p/{pack}/system/status/outputs/{id}:
    get:
      operationId: getOutputStatusSystemOutputsByPackAndId
      tags:
        - destinations
      x-speakeasy-group: packs.destinations.statuses
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the status of a Destination within a Pack
      description: Get the status and optional metrics for the specified Destination
        within the specified Pack.
      responses:
        "200":
          description: Destination status object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputStatus"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Destination to get the status for.
        - name: metrics
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include metrics for each Destination.
            Otherwise, <code>false</code> (default).
        - name: type
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to prefix the Destination <code>id</code>
            with the Destination type. Otherwise, <code>false</code> (default).
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/status/outputs:
    get:
      operationId: getOutputStatusSystemOutputsByPack
      tags:
        - destinations
      x-speakeasy-group: packs.destinations.statuses
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List the status of all Destinations within a Pack
      description: List status information and optional metrics for all configured
        Destinations in the Worker Group or Edge Fleet within the specified
        Pack.
      responses:
        "200":
          description: a list of Destination status objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutputStatus"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: metrics
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include metrics for each Destination.
            Otherwise, <code>false</code> (default).
        - name: type
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to prefix the Destination <code>id</code>
            with the Destination type. Otherwise, <code>false</code> (default).
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of items to return in the response for this request.
            Use with <code>offset</code> to paginate the response into
            manageable batches.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /system/outpost/{id}:
    get:
      operationId: getOutpostConfigsById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - outpost
      summary: Get OutpostConfigs by ID
      description: Get OutpostConfigs by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of OutpostConfigs objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutpostConfigs"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateOutpostConfigsById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - outpost
      summary: Update an Outpost Node
      description: Update the configuration for the specified Outpost Node.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Outpost Node to update.
      requestBody:
        description: OutpostConfigs object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/OutpostConfigs"
            examples:
              OutpostConfigExamplesOutpostConfig:
                $ref: "#/components/examples/OutpostConfigExamplesOutpostConfig"
      responses:
        "200":
          description: The updated OutpostConfigs object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutpostConfigs"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: outposts.configs
  /system/pq/orphan-management:
    get:
      operationId: getPQOrphanManagementConfig
      tags:
        - pqorphanmanagement
      x-speakeasy-group: pq.orphanManagement
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get PQ orphan management configuration
      description: Get the orphan management configuration for persistent queue (PQ)
        on shared storage. Orphan management reassigns queue data left by
        Workers that the Leader no longer considers active.
      responses:
        "200":
          description: The orphan management configuration.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPqOrphanManagementConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updatePQOrphanManagementConfig
      tags:
        - pqorphanmanagement
      x-speakeasy-group: pq.orphanManagement
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update PQ orphan management configuration
      description: Update the orphan management configuration for persistent queue
        (PQ) on shared storage. Not supported for Cribl.Cloud-provisioned Worker
        Groups and Edge Fleets.<br/><br/>Provide a complete representation of
        the orphan management configuration that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the orphan management
        configuration.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated orphan management configuration might not
        function as expected.
      responses:
        "200":
          description: The updated orphan management configuration.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPqOrphanManagementConfig"
        "400":
          description: The request body is invalid or the Worker Group or Edge Fleet is
            Cribl.Cloud-provisioned.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: PQOrphanManagementConfig object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PQOrphanManagementConfig"
            examples:
              PQOrphanManagementConfigExamplesDefaults:
                $ref: "#/components/examples/PQOrphanManagementConfigExamplesDefaults"
              PQOrphanManagementConfigExamplesFrequentScan:
                $ref: "#/components/examples/PQOrphanManagementConfigExamplesFrequentScan"
              PQOrphanManagementConfigExamplesDisabled:
                $ref: "#/components/examples/PQOrphanManagementConfigExamplesDisabled"
  /system/pq/storage:
    get:
      operationId: getPQStorageConfig
      tags:
        - pqstorage
      x-speakeasy-group: pq.storage
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the persistent queue storage configuration
      description: Get the current configuration for persistent queue (PQ) storage.
      responses:
        "200":
          description: The current PQ storage configuration
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPqStorageConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updatePQStorageConfig
      tags:
        - pqstorage
      x-speakeasy-group: pq.storage
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update the persistent queue storage configuration
      description: Update the configuration for persistent queue (PQ)
        storage.<br/><br/>Provide a complete representation of the PQ storage
        configuration that you want to update in the request body. This endpoint
        does not support partial updates. Cribl removes any omitted fields when
        updating the PQ storage configuration.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated PQ storage
        configuration might not function as expected.
      responses:
        "200":
          description: The updated PQ storage configuration on success.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPqStorageConfig"
        "400":
          description: The request body fails validation, or the Worker Group or Edge
            Fleet is Cribl.Cloud-provisioned and the configuration is not S3
            (type <code>s3</code>) or platform NFS (type <code>nfs</code>). For
            provisioned groups, type <code>nfs</code> is saved only as the
            canonical SaaS defaults, regardless of other fields in the request.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: PQStorageConfig object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PQStorageConfig"
            examples:
              PQStorageConfigExamplesFileSystem:
                $ref: "#/components/examples/PQStorageConfigExamplesFileSystem"
              PQStorageConfigExamplesNetworkFileSystemMinimal:
                $ref: "#/components/examples/PQStorageConfigExamplesNetworkFileSystemMinimal"
              PQStorageConfigExamplesNetworkFileSystem:
                $ref: "#/components/examples/PQStorageConfigExamplesNetworkFileSystem"
              PQStorageConfigExamplesS3Auto:
                $ref: "#/components/examples/PQStorageConfigExamplesS3Auto"
              PQStorageConfigExamplesS3Manual:
                $ref: "#/components/examples/PQStorageConfigExamplesS3Manual"
              PQStorageConfigExamplesS3Secret:
                $ref: "#/components/examples/PQStorageConfigExamplesS3Secret"
              PQStorageConfigExamplesS3AssumeRole:
                $ref: "#/components/examples/PQStorageConfigExamplesS3AssumeRole"
  /lib/appscope-configs:
    get:
      operationId: listAppscopeLibEntry
      deprecated: true
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - appscope-configs
      summary: Get a list of AppscopeLibEntry objects
      description: Get a list of AppscopeLibEntry objects.
      responses:
        "200":
          description: List of AppscopeLibEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppscopeLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createAppscopeLibEntry
      deprecated: true
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - appscope-configs
      summary: Create AppscopeLibEntry
      description: Create AppscopeLibEntry.
      requestBody:
        description: New AppscopeLibEntry object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AppscopeLibEntry"
      responses:
        "200":
          description: The created AppscopeLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppscopeLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/appscope-configs/{id}:
    get:
      operationId: getAppscopeLibEntryById
      deprecated: true
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - appscope-configs
      summary: Get AppscopeLibEntry by ID
      description: Get AppscopeLibEntry by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of AppscopeLibEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppscopeLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateAppscopeLibEntryById
      deprecated: true
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - appscope-configs
      summary: Update AppscopeLibEntry
      description: Update AppscopeLibEntry.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to PATCH
      requestBody:
        description: AppscopeLibEntry object to be updated.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AppscopeLibEntry"
      responses:
        "200":
          description: The updated AppscopeLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppscopeLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteAppscopeLibEntryById
      deprecated: true
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - appscope-configs
      summary: Delete AppscopeLibEntry
      description: Delete AppscopeLibEntry.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted AppscopeLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppscopeLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/grok:
    get:
      operationId: listGrokFile
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - grokfiles
      summary: List all Grok files
      description: Get a list of all Grok files.
      responses:
        "200":
          description: List of GrokFile objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGrokFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createGrokFile
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - grokfiles
      summary: Create a Grok file
      description: Create a new Grok file.
      requestBody:
        description: GrokFile object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GrokFile"
            examples:
              GrokFileExamplesCustomPattern:
                $ref: "#/components/examples/GrokFileExamplesCustomPattern"
              GrokFileExamplesNetworkPatterns:
                $ref: "#/components/examples/GrokFileExamplesNetworkPatterns"
      responses:
        "200":
          description: The created GrokFile object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGrokFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/grok/{id}:
    get:
      operationId: getGrokFileById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - grokfiles
      summary: Get GrokFile by ID
      description: Get GrokFile by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of GrokFile objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGrokFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateGrokFileById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - grokfiles
      summary: Update a Grok file
      description: Update the specified Grok file.<br/><br/>Provide a complete
        representation of the Grok file that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Grok file.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Grok file might
        not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Grok file to update.
      requestBody:
        description: GrokFile object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GrokFile"
            examples:
              GrokFileExamplesCustomPattern:
                $ref: "#/components/examples/GrokFileExamplesCustomPattern"
              GrokFileExamplesNetworkPatterns:
                $ref: "#/components/examples/GrokFileExamplesNetworkPatterns"
      responses:
        "200":
          description: The updated GrokFile object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGrokFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteGrokFileById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - grokfiles
      summary: Delete GrokFile
      description: Delete GrokFile.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted GrokFile object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGrokFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/lib/grok:
    post:
      operationId: createGrokFileLibGrokByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - grokfiles
      summary: Create a Grok file within a Pack
      description: Create a new Grok file within the specified Pack.
      requestBody:
        description: GrokFile object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GrokFile"
            examples:
              GrokFileExamplesCustomPattern:
                $ref: "#/components/examples/GrokFileExamplesCustomPattern"
              GrokFileExamplesNetworkPatterns:
                $ref: "#/components/examples/GrokFileExamplesNetworkPatterns"
      responses:
        "200":
          description: The created GrokFile object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGrokFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.grokfiles
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getGrokFileLibGrokByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - grokfiles
      summary: List all Grok files within a Pack
      description: Get a list of all Grok files within the specified Pack.
      responses:
        "200":
          description: List of GrokFile objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGrokFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.grokfiles
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/lib/grok/{id}:
    patch:
      operationId: updateGrokFileLibGrokByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - grokfiles
      summary: Update a Grok file within a Pack
      description: Update the specified Grok file.<br/><br/>Provide a complete
        representation of the Grok file that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Grok file.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Grok file might
        not function as expected within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Grok file to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: GrokFile object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GrokFile"
            examples:
              GrokFileExamplesCustomPattern:
                $ref: "#/components/examples/GrokFileExamplesCustomPattern"
              GrokFileExamplesNetworkPatterns:
                $ref: "#/components/examples/GrokFileExamplesNetworkPatterns"
      responses:
        "200":
          description: The updated GrokFile object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGrokFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.grokfiles
  /lib/jobs:
    post:
      operationId: createSavedJob
      tags:
        - collectors
      x-speakeasy-group: collectors
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Collector
      description: Create a new Collector.
      responses:
        "200":
          description: The created SavedJobResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedJobResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SavedJob object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SavedJob"
            examples:
              CollectorExamplesRest:
                $ref: "#/components/examples/CollectorExamplesRest"
              CollectorExamplesS3:
                $ref: "#/components/examples/CollectorExamplesS3"
              CollectorExamplesFilesystem:
                $ref: "#/components/examples/CollectorExamplesFilesystem"
              CollectorExamplesAzureBlob:
                $ref: "#/components/examples/CollectorExamplesAzureBlob"
              CollectorExamplesGoogleCloudStorage:
                $ref: "#/components/examples/CollectorExamplesGoogleCloudStorage"
              CollectorExamplesDatabase:
                $ref: "#/components/examples/CollectorExamplesDatabase"
              CollectorExamplesSplunk:
                $ref: "#/components/examples/CollectorExamplesSplunk"
              CollectorExamplesScript:
                $ref: "#/components/examples/CollectorExamplesScript"
              CollectorExamplesCriblLake:
                $ref: "#/components/examples/CollectorExamplesCriblLake"
    get:
      operationId: getSavedJob
      tags:
        - collectors
      x-speakeasy-group: collectors
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Collectors
      description: Get a list of all Collectors.
      responses:
        "200":
          description: List of SavedJobResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedJobResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: collectorType
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/CollectorType"
          description: Filter by collector type
  /lib/jobs/{id}:
    delete:
      operationId: deleteSavedJobById
      tags:
        - collectors
      x-speakeasy-group: collectors
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Collector
      description: Delete the specified Collector.
      responses:
        "200":
          description: The deleted SavedJobResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedJobResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Collector to delete.
    get:
      operationId: getSavedJobById
      tags:
        - collectors
      x-speakeasy-group: collectors
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Collector
      description: Get the specified Collector.
      responses:
        "200":
          description: List of SavedJobResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedJobResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Collector to get.
    patch:
      operationId: updateSavedJobById
      tags:
        - collectors
      x-speakeasy-group: collectors
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Collector
      description: Update the specified Collector.<br/><br/>Provide a complete
        representation of the Collector that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Collector.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Collector might
        not function as expected.
      responses:
        "200":
          description: The updated SavedJobResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedJobResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SavedJob object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SavedJob"
            examples:
              CollectorExamplesRest:
                $ref: "#/components/examples/CollectorExamplesRest"
              CollectorExamplesS3:
                $ref: "#/components/examples/CollectorExamplesS3"
              CollectorExamplesFilesystem:
                $ref: "#/components/examples/CollectorExamplesFilesystem"
              CollectorExamplesAzureBlob:
                $ref: "#/components/examples/CollectorExamplesAzureBlob"
              CollectorExamplesGoogleCloudStorage:
                $ref: "#/components/examples/CollectorExamplesGoogleCloudStorage"
              CollectorExamplesDatabase:
                $ref: "#/components/examples/CollectorExamplesDatabase"
              CollectorExamplesSplunk:
                $ref: "#/components/examples/CollectorExamplesSplunk"
              CollectorExamplesScript:
                $ref: "#/components/examples/CollectorExamplesScript"
              CollectorExamplesCriblLake:
                $ref: "#/components/examples/CollectorExamplesCriblLake"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Collector to update.
  /p/{pack}/lib/jobs:
    post:
      operationId: createSavedJobLibByPack
      tags:
        - collectors
      x-speakeasy-group: packs.collectors
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Collector within a Pack
      description: Create a new Collector within the specified Pack.
      responses:
        "200":
          description: The created SavedJobResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedJobResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SavedJob object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SavedJob"
            examples:
              CollectorExamplesRest:
                $ref: "#/components/examples/CollectorExamplesRest"
              CollectorExamplesS3:
                $ref: "#/components/examples/CollectorExamplesS3"
              CollectorExamplesFilesystem:
                $ref: "#/components/examples/CollectorExamplesFilesystem"
              CollectorExamplesAzureBlob:
                $ref: "#/components/examples/CollectorExamplesAzureBlob"
              CollectorExamplesGoogleCloudStorage:
                $ref: "#/components/examples/CollectorExamplesGoogleCloudStorage"
              CollectorExamplesDatabase:
                $ref: "#/components/examples/CollectorExamplesDatabase"
              CollectorExamplesSplunk:
                $ref: "#/components/examples/CollectorExamplesSplunk"
              CollectorExamplesScript:
                $ref: "#/components/examples/CollectorExamplesScript"
              CollectorExamplesCriblLake:
                $ref: "#/components/examples/CollectorExamplesCriblLake"
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getSavedJobLibByPack
      tags:
        - collectors
      x-speakeasy-group: packs.collectors
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Collectors within a Pack
      description: Get a list of all Collectors within the specified Pack.
      responses:
        "200":
          description: List of SavedJobResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedJobResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: collectorType
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/CollectorType"
          description: Filter by collector type
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/lib/jobs/{id}:
    delete:
      operationId: deleteSavedJobLibByPackAndId
      tags:
        - collectors
      x-speakeasy-group: packs.collectors
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Collector within a Pack
      description: Delete the specified Collector within the specified Pack.
      responses:
        "200":
          description: The deleted SavedJobResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedJobResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Collector to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getSavedJobLibByPackAndId
      tags:
        - collectors
      x-speakeasy-group: packs.collectors
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Collector within a Pack
      description: Get the specified Collector within the specified Pack.
      responses:
        "200":
          description: List of SavedJobResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedJobResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Collector to get.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    patch:
      operationId: updateSavedJobLibByPackAndId
      tags:
        - collectors
      x-speakeasy-group: packs.collectors
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Collector within a Pack
      description: Update the specified Collector.<br/><br/>Provide a complete
        representation of the Collector that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Collector.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Collector might
        not function as expected within the specified Pack.
      responses:
        "200":
          description: The updated SavedJobResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedJobResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SavedJob object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SavedJob"
            examples:
              CollectorExamplesRest:
                $ref: "#/components/examples/CollectorExamplesRest"
              CollectorExamplesS3:
                $ref: "#/components/examples/CollectorExamplesS3"
              CollectorExamplesFilesystem:
                $ref: "#/components/examples/CollectorExamplesFilesystem"
              CollectorExamplesAzureBlob:
                $ref: "#/components/examples/CollectorExamplesAzureBlob"
              CollectorExamplesGoogleCloudStorage:
                $ref: "#/components/examples/CollectorExamplesGoogleCloudStorage"
              CollectorExamplesDatabase:
                $ref: "#/components/examples/CollectorExamplesDatabase"
              CollectorExamplesSplunk:
                $ref: "#/components/examples/CollectorExamplesSplunk"
              CollectorExamplesScript:
                $ref: "#/components/examples/CollectorExamplesScript"
              CollectorExamplesCriblLake:
                $ref: "#/components/examples/CollectorExamplesCriblLake"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Collector to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /system/lookups/{id}/clone:
    put:
      operationId: updateLookupFileCloneById
      tags:
        - lookups
      x-speakeasy-group: lookups
      x-speakeasy-name-override: clone
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Clone a Lookup
      description: "Clone the specified Lookup and its underlying Lookup file to a new
        context or under a new name.<br/><br/>Supported clone directions:
        Pack→Pack, Pack→Global, Global→Pack. Cloning to the same context
        (Global→Global or Pack→same Pack) is not supported."
      responses:
        "200":
          description: Cloned Lookup
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Lookup not found
        "409":
          description: Conflict
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LookupCloneBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LookupCloneBody"
            examples:
              CloneLookupExamplesCloneToDefaultPack:
                $ref: "#/components/examples/CloneLookupExamplesCloneToDefaultPack"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lookup to clone.
  /system/lookups:
    post:
      operationId: createLookupFile
      tags:
        - lookups
      x-speakeasy-group: lookups
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Lookup
      description: Create a Lookup using either inline content or by referencing a
        Lookup file previously uploaded with <code>PUT /system/lookups</code>.
      responses:
        "200":
          description: Created Lookup
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "413":
          description: Content too large
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LookupFile object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LookupFile"
            examples:
              CreateLookupFileExamplesCSVLookup:
                $ref: "#/components/examples/CreateLookupFileExamplesCSVLookup"
    put:
      operationId: updateLookupFile
      tags:
        - lookups
      x-speakeasy-group: lookups
      x-speakeasy-name-override: upload
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Upload a Lookup file
      description: Upload the specified Lookup file in CSV format as binary
        data.<br/><br> After uploading the file, use <code>POST
        /system/lookups</code> to create a Lookup using the uploaded file and
        make the Lookup available.<br/><br> Also supports canceling the upload
        operation.
      responses:
        "200":
          description: Uploaded Lookup file
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LookupFileInfoResponse"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "413":
          description: Content too large
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LookupFileInfo object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LookupFileInfo"
            examples:
              LookupFileInfoExamplesCancelUpload:
                $ref: "#/components/examples/LookupFileInfoExamplesCancelUpload"
          text/csv:
            schema:
              type: string
              format: binary
              description: CSV lookup file
      parameters:
        - name: filename
          in: query
          required: true
          schema:
            type: string
          description: Name of the Lookup file to upload.
        - name: cancel
          in: query
          required: false
          schema:
            type: boolean
          description: To cancel the file upload operation, <code>true</code>.
    get:
      operationId: getLookupFile
      tags:
        - lookups
      x-speakeasy-group: lookups
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Lookups
      description: Get a list of all Lookups.
      responses:
        "200":
          description: List of Lookup objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: ext
          in: query
          required: false
          schema:
            type: string
          description: Limit the response to Lookups whose underlying Lookup files have
            the specified file extension.
  /system/lookups/{id}:
    delete:
      operationId: deleteLookupFileById
      tags:
        - lookups
      x-speakeasy-group: lookups
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Lookup
      description: Delete the specified Lookup and its associated Lookup file.
      responses:
        "200":
          description: Deleted Lookup
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lookup to delete.
    get:
      operationId: getLookupFileById
      tags:
        - lookups
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Lookup
      description: Get the specified Lookup.
      responses:
        "200":
          description: List of LookupFile objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lookup to get.
    patch:
      operationId: updateLookupFileById
      tags:
        - lookups
      x-speakeasy-group: lookups
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Lookup
      description: Update the specified Lookup.<br/><br/>Provide a complete
        representation of the Lookup that you want to update in the request
        body.<br/><br/>This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Lookup.<br/><br/>Confirm
        that the configuration in your request body is correct before sending
        the request.<br/><br/>If the configuration is incorrect, the updated
        Lookup might not function as expected.
      responses:
        "200":
          description: Updated Lookup
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LookupFile object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LookupFile"
            examples:
              UpdateLookupFileExamplesUpdateLookup:
                $ref: "#/components/examples/UpdateLookupFileExamplesUpdateLookup"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lookup to update.
  /p/{pack}/system/lookups/{id}/clone:
    put:
      operationId: updateLookupFileSystemLookupsCloneByPackAndId
      tags:
        - lookups
      x-speakeasy-group: packs.lookups
      x-speakeasy-name-override: clone
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Clone a Lookup within a Pack
      description: "Clone the specified Lookup and its underlying Lookup file to a new
        context or under a new name.<br/><br/>Supported clone directions:
        Pack→Pack, Pack→Global, Global→Pack. Cloning to the same context
        (Global→Global or Pack→same Pack) is not supported within the specified
        Pack."
      responses:
        "200":
          description: Cloned Lookup
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Lookup not found
        "409":
          description: Conflict
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LookupCloneBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LookupCloneBody"
            examples:
              CloneLookupExamplesCloneToDefaultPack:
                $ref: "#/components/examples/CloneLookupExamplesCloneToDefaultPack"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lookup to clone.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/lookups:
    post:
      operationId: createLookupFileSystemLookupsByPack
      tags:
        - lookups
      x-speakeasy-group: packs.lookups
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Lookup within a Pack
      description: Create a Lookup using either inline content or by referencing a
        Lookup file previously uploaded with <code>PUT /system/lookups</code>
        within the specified Pack.
      responses:
        "200":
          description: Created Lookup
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "413":
          description: Content too large
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LookupFile object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LookupFile"
            examples:
              CreateLookupFileExamplesCSVLookup:
                $ref: "#/components/examples/CreateLookupFileExamplesCSVLookup"
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    put:
      operationId: updateLookupFileSystemLookupsByPack
      tags:
        - lookups
      x-speakeasy-group: packs.lookups
      x-speakeasy-name-override: upload
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Upload a Lookup file within a Pack
      description: Upload the specified Lookup file in CSV format as binary
        data.<br/><br> After uploading the file, use <code>POST
        /system/lookups</code> to create a Lookup using the uploaded file and
        make the Lookup available.<br/><br> Also supports canceling the upload
        operation within the specified Pack.
      responses:
        "200":
          description: Uploaded Lookup file
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LookupFileInfoResponse"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "413":
          description: Content too large
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LookupFileInfo object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LookupFileInfo"
            examples:
              LookupFileInfoExamplesCancelUpload:
                $ref: "#/components/examples/LookupFileInfoExamplesCancelUpload"
          text/csv:
            schema:
              type: string
              format: binary
              description: CSV lookup file
      parameters:
        - name: filename
          in: query
          required: true
          schema:
            type: string
          description: Name of the Lookup file to upload.
        - name: cancel
          in: query
          required: false
          schema:
            type: boolean
          description: To cancel the file upload operation, <code>true</code>.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getLookupFileSystemLookupsByPack
      tags:
        - lookups
      x-speakeasy-group: packs.lookups
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Lookups within a Pack
      description: Get a list of all Lookups within the specified Pack.
      responses:
        "200":
          description: List of Lookup objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: ext
          in: query
          required: false
          schema:
            type: string
          description: Limit the response to Lookups whose underlying Lookup files have
            the specified file extension.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/lookups/{id}:
    delete:
      operationId: deleteLookupFileSystemLookupsByPackAndId
      tags:
        - lookups
      x-speakeasy-group: packs.lookups
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Lookup within a Pack
      description: Delete the specified Lookup and its associated Lookup file within
        the specified Pack.
      responses:
        "200":
          description: Deleted Lookup
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lookup to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getLookupFileSystemLookupsByPackAndId
      tags:
        - lookups
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Lookup within a Pack
      description: Get the specified Lookup within the specified Pack.
      responses:
        "200":
          description: List of LookupFile objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lookup to get.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-group: packs.lookups
    patch:
      operationId: updateLookupFileSystemLookupsByPackAndId
      tags:
        - lookups
      x-speakeasy-group: packs.lookups
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Lookup within a Pack
      description: Update the specified Lookup.<br/><br/>Provide a complete
        representation of the Lookup that you want to update in the request
        body.<br/><br/>This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Lookup.<br/><br/>Confirm
        that the configuration in your request body is correct before sending
        the request.<br/><br/>If the configuration is incorrect, the updated
        Lookup might not function as expected within the specified Pack.
      responses:
        "200":
          description: Updated Lookup
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLookupFile"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LookupFile object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LookupFile"
            examples:
              UpdateLookupFileExamplesUpdateLookup:
                $ref: "#/components/examples/UpdateLookupFileExamplesUpdateLookup"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lookup to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /lib/parsers:
    get:
      operationId: listParser
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - parsers
      summary: List all parsers
      description: Get a list of all parsers.
      responses:
        "200":
          description: List of Parser objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedParserLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createParser
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - parsers
      summary: Create a Parser
      description: Create a new Parser.
      requestBody:
        description: Parser object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ParserLibEntry"
            examples:
              ParserExamplesCsvParser:
                $ref: "#/components/examples/ParserExamplesCsvParser"
              ParserExamplesJsonParser:
                $ref: "#/components/examples/ParserExamplesJsonParser"
              ParserExamplesRegexParser:
                $ref: "#/components/examples/ParserExamplesRegexParser"
              ParserExamplesGrokParser:
                $ref: "#/components/examples/ParserExamplesGrokParser"
      responses:
        "200":
          description: The created Parser object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedParserLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/parsers/{id}:
    get:
      operationId: getParserById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - parsers
      summary: Get Parser by ID
      description: Get Parser by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Parser objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedParserLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateParserById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - parsers
      summary: Update a Parser
      description: Update the specified Parser.<br/><br/>Provide a complete
        representation of the Parser that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Parser.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Parser might not
        function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Parser to update.
      requestBody:
        description: Parser object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ParserLibEntry"
            examples:
              ParserExamplesCsvParser:
                $ref: "#/components/examples/ParserExamplesCsvParser"
              ParserExamplesJsonParser:
                $ref: "#/components/examples/ParserExamplesJsonParser"
              ParserExamplesRegexParser:
                $ref: "#/components/examples/ParserExamplesRegexParser"
              ParserExamplesGrokParser:
                $ref: "#/components/examples/ParserExamplesGrokParser"
      responses:
        "200":
          description: The updated Parser object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedParserLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteParserById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - parsers
      summary: Delete Parser
      description: Delete Parser.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted Parser object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedParserLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/lib/parsers:
    post:
      operationId: createParserLibByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - parsers
      summary: Create a Parser within a Pack
      description: Create a new Parser within the specified Pack.
      requestBody:
        description: Parser object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ParserLibEntry"
            examples:
              ParserExamplesCsvParser:
                $ref: "#/components/examples/ParserExamplesCsvParser"
              ParserExamplesJsonParser:
                $ref: "#/components/examples/ParserExamplesJsonParser"
              ParserExamplesRegexParser:
                $ref: "#/components/examples/ParserExamplesRegexParser"
              ParserExamplesGrokParser:
                $ref: "#/components/examples/ParserExamplesGrokParser"
      responses:
        "200":
          description: The created Parser object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedParserLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.parsers
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getParserLibByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - parsers
      summary: List all parsers within a Pack
      description: Get a list of all parsers within the specified Pack.
      responses:
        "200":
          description: List of Parser objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedParserLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.parsers
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/lib/parsers/{id}:
    patch:
      operationId: updateParserLibByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - parsers
      summary: Update a Parser within a Pack
      description: Update the specified Parser.<br/><br/>Provide a complete
        representation of the Parser that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Parser.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Parser might not
        function as expected within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Parser to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: Parser object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ParserLibEntry"
            examples:
              ParserExamplesCsvParser:
                $ref: "#/components/examples/ParserExamplesCsvParser"
              ParserExamplesJsonParser:
                $ref: "#/components/examples/ParserExamplesJsonParser"
              ParserExamplesRegexParser:
                $ref: "#/components/examples/ParserExamplesRegexParser"
              ParserExamplesGrokParser:
                $ref: "#/components/examples/ParserExamplesGrokParser"
      responses:
        "200":
          description: The updated Parser object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedParserLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.parsers
  /lib/protobuf-libraries/{id}/encodings/{encid}:
    get:
      operationId: getProtobufLibraryConfigEncodingsByIdAndEncId
      tags:
        - protobuflibraries
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get an encoding for a Protobuf library
      description: Show Protobuf library encodings by encoding id.
      responses:
        "200":
          description: List of ProtobufEncodingConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProtobufEncodingConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Library id
        - name: encid
          in: path
          required: true
          schema:
            type: string
          description: Encoding id
  /lib/protobuf-libraries/{id}:
    get:
      operationId: getProtobufLibraryConfigById
      tags:
        - protobuflibraries
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Protobuf library
      description: Show Library by Id.
      responses:
        "200":
          description: List of ProtobufLibraryConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProtobufLibraryConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Library Id
  /lib/protobuf-libraries:
    get:
      operationId: getProtobufLibraryConfig
      tags:
        - protobuflibraries
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Protobuf libraries
      description: Show list of Protobuf encodings for a given Library.
      responses:
        "200":
          description: List of ProtobufEncodingConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProtobufEncodingConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: onlyWithEncodings
          in: query
          required: true
          schema:
            type: string
          description: onlyWithEncodings
  /lib/protobuf-libraries/{id}/encodings:
    get:
      operationId: getProtobufLibraryConfigEncodingsById
      tags:
        - protobuflibraries
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List encodings for a Protobuf library
      description: Show list of Protobuf encodings for a given Library.
      responses:
        "200":
          description: List of ProtobufEncodingConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProtobufEncodingConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Library id
  /lib/regex:
    get:
      operationId: listRegexLibEntry
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - regexes
      summary: List all Regex Library entries
      description: Get a list of all Regex Library entries.
      responses:
        "200":
          description: List of RegexLibEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRegexLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createRegexLibEntry
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - regexes
      summary: Create a Regex Library entry
      description: Create a new Regex Library entry.
      requestBody:
        description: RegexLibEntry object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RegexLibEntry"
            examples:
              RegexExamplesIpAddress:
                $ref: "#/components/examples/RegexExamplesIpAddress"
              RegexExamplesEmailAddress:
                $ref: "#/components/examples/RegexExamplesEmailAddress"
              RegexExamplesHttpStatusCode:
                $ref: "#/components/examples/RegexExamplesHttpStatusCode"
      responses:
        "200":
          description: The created RegexLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRegexLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/regex/{id}:
    get:
      operationId: getRegexLibEntryById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - regexes
      summary: Get RegexLibEntry by ID
      description: Get RegexLibEntry by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of RegexLibEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRegexLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateRegexLibEntryById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - regexes
      summary: Update a Regex Library entry
      description: Update the specified Regex Library entry.<br/><br/>Provide a
        complete representation of the Regex Library entry that you want to
        update in the request body. This endpoint does not support partial
        updates. Cribl removes any omitted fields when updating the Regex
        Library entry.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated Regex Library entry might not function as
        expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Regex Library entry to update.
      requestBody:
        description: RegexLibEntry object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RegexLibEntry"
            examples:
              RegexExamplesIpAddress:
                $ref: "#/components/examples/RegexExamplesIpAddress"
              RegexExamplesEmailAddress:
                $ref: "#/components/examples/RegexExamplesEmailAddress"
              RegexExamplesHttpStatusCode:
                $ref: "#/components/examples/RegexExamplesHttpStatusCode"
      responses:
        "200":
          description: The updated RegexLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRegexLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteRegexLibEntryById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - regexes
      summary: Delete RegexLibEntry
      description: Delete RegexLibEntry.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted RegexLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRegexLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/lib/regex:
    post:
      operationId: createRegexLibEntryLibRegexByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - regexes
      summary: Create a Regex Library entry within a Pack
      description: Create a new Regex Library entry within the specified Pack.
      requestBody:
        description: RegexLibEntry object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RegexLibEntry"
            examples:
              RegexExamplesIpAddress:
                $ref: "#/components/examples/RegexExamplesIpAddress"
              RegexExamplesEmailAddress:
                $ref: "#/components/examples/RegexExamplesEmailAddress"
              RegexExamplesHttpStatusCode:
                $ref: "#/components/examples/RegexExamplesHttpStatusCode"
      responses:
        "200":
          description: The created RegexLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRegexLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.regexes
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getRegexLibEntryLibRegexByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - regexes
      summary: List all Regex Library entries within a Pack
      description: Get a list of all Regex Library entries within the specified Pack.
      responses:
        "200":
          description: List of RegexLibEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRegexLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.regexes
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/lib/regex/{id}:
    patch:
      operationId: updateRegexLibEntryLibRegexByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - regexes
      summary: Update a Regex Library entry within a Pack
      description: Update the specified Regex Library entry.<br/><br/>Provide a
        complete representation of the Regex Library entry that you want to
        update in the request body. This endpoint does not support partial
        updates. Cribl removes any omitted fields when updating the Regex
        Library entry.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated Regex Library entry might not function as
        expected within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Regex Library entry to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: RegexLibEntry object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RegexLibEntry"
            examples:
              RegexExamplesIpAddress:
                $ref: "#/components/examples/RegexExamplesIpAddress"
              RegexExamplesEmailAddress:
                $ref: "#/components/examples/RegexExamplesEmailAddress"
              RegexExamplesHttpStatusCode:
                $ref: "#/components/examples/RegexExamplesHttpStatusCode"
      responses:
        "200":
          description: The updated RegexLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRegexLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.regexes
  /lib/sds-rules:
    get:
      operationId: listSensitiveDataRule
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - sdsRules
      summary: List all sensitive data scanning (SDS) rules
      description: Get a list of all sensitive data scanning (SDS) rules.
      responses:
        "200":
          description: List of SensitiveDataRule objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createSensitiveDataRule
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - sdsRules
      summary: Create a sensitive data scanning (SDS) rule
      description: Create a new sensitive data scanning (SDS) rule.
      requestBody:
        description: SensitiveDataRule object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SensitiveDataRule"
            examples:
              SDSRuleExamplesCreditCard:
                $ref: "#/components/examples/SDSRuleExamplesCreditCard"
              SDSRuleExamplesSocialSecurityNumber:
                $ref: "#/components/examples/SDSRuleExamplesSocialSecurityNumber"
              SDSRuleExamplesEmailAddress:
                $ref: "#/components/examples/SDSRuleExamplesEmailAddress"
      responses:
        "200":
          description: The created SensitiveDataRule object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/sds-rules/{id}:
    get:
      operationId: getSensitiveDataRuleById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - sdsRules
      summary: Get SensitiveDataRule by ID
      description: Get SensitiveDataRule by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of SensitiveDataRule objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSensitiveDataRuleById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - sdsRules
      summary: Update a sensitive data scanning (SDS) rule
      description: Update the specified sensitive data scanning (SDS)
        rule.<br/><br/>Provide a complete representation of the SDS rule that
        you want to update in the request body. This endpoint does not support
        partial updates. Cribl removes any omitted fields when updating the SDS
        rule.<br/><br/>Confirm that the configuration in your request body is
        correct before sending the request. If the configuration is incorrect,
        the updated SDS rule might not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the SDS rule to update.
      requestBody:
        description: SensitiveDataRule object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SensitiveDataRule"
            examples:
              SDSRuleExamplesCreditCard:
                $ref: "#/components/examples/SDSRuleExamplesCreditCard"
              SDSRuleExamplesSocialSecurityNumber:
                $ref: "#/components/examples/SDSRuleExamplesSocialSecurityNumber"
              SDSRuleExamplesEmailAddress:
                $ref: "#/components/examples/SDSRuleExamplesEmailAddress"
      responses:
        "200":
          description: The updated SensitiveDataRule object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteSensitiveDataRuleById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - sdsRules
      summary: Delete SensitiveDataRule
      description: Delete SensitiveDataRule.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted SensitiveDataRule object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/lib/sds-rules:
    post:
      operationId: createSensitiveDataRuleLibByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - sdsRules
      summary: Create a sensitive data scanning (SDS) rule within a Pack
      description: Create a new sensitive data scanning (SDS) rule within the
        specified Pack.
      requestBody:
        description: SensitiveDataRule object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SensitiveDataRule"
            examples:
              SDSRuleExamplesCreditCard:
                $ref: "#/components/examples/SDSRuleExamplesCreditCard"
              SDSRuleExamplesSocialSecurityNumber:
                $ref: "#/components/examples/SDSRuleExamplesSocialSecurityNumber"
              SDSRuleExamplesEmailAddress:
                $ref: "#/components/examples/SDSRuleExamplesEmailAddress"
      responses:
        "200":
          description: The created SensitiveDataRule object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.sdsRules
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getSensitiveDataRuleLibByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - sdsRules
      summary: List all sensitive data scanning (SDS) rules within a Pack
      description: Get a list of all sensitive data scanning (SDS) rules within the
        specified Pack.
      responses:
        "200":
          description: List of SensitiveDataRule objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.sdsRules
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/lib/sds-rules/{id}:
    patch:
      operationId: updateSensitiveDataRuleLibByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - sdsRules
      summary: Update a sensitive data scanning (SDS) rule within a Pack
      description: Update the specified sensitive data scanning (SDS)
        rule.<br/><br/>Provide a complete representation of the SDS rule that
        you want to update in the request body. This endpoint does not support
        partial updates. Cribl removes any omitted fields when updating the SDS
        rule.<br/><br/>Confirm that the configuration in your request body is
        correct before sending the request. If the configuration is incorrect,
        the updated SDS rule might not function as expected within the specified
        Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the SDS rule to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: SensitiveDataRule object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SensitiveDataRule"
            examples:
              SDSRuleExamplesCreditCard:
                $ref: "#/components/examples/SDSRuleExamplesCreditCard"
              SDSRuleExamplesSocialSecurityNumber:
                $ref: "#/components/examples/SDSRuleExamplesSocialSecurityNumber"
              SDSRuleExamplesEmailAddress:
                $ref: "#/components/examples/SDSRuleExamplesEmailAddress"
      responses:
        "200":
          description: The updated SensitiveDataRule object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.sdsRules
  /lib/sds-rulesets:
    get:
      operationId: listSensitiveDataRuleset
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - sds-rulesets
      summary: Get a list of SensitiveDataRuleset objects
      description: Get a list of SensitiveDataRuleset objects.
      responses:
        "200":
          description: List of SensitiveDataRuleset objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /lib/sds-rulesets/{id}:
    get:
      operationId: getSensitiveDataRulesetById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - sds-rulesets
      summary: Get SensitiveDataRuleset by ID
      description: Get SensitiveDataRuleset by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of SensitiveDataRuleset objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteSensitiveDataRulesetById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - sds-rulesets
      summary: Delete SensitiveDataRuleset
      description: Delete SensitiveDataRuleset.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted SensitiveDataRuleset object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSensitiveDataRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/samples:
    get:
      operationId: listDataSample
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - samples
      summary: Get a list of DataSample objects
      description: Get a list of DataSample objects.
      responses:
        "200":
          description: List of DataSample objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createDataSample
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - samples
      summary: Create a data sample
      description: Create a new data sample.
      requestBody:
        description: DataSample object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataSample"
            examples:
              CreateSampleExamplesBasicSample:
                $ref: "#/components/examples/CreateSampleExamplesBasicSample"
      responses:
        "200":
          description: The created DataSample object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/samples/{id}:
    get:
      operationId: getDataSampleById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - samples
      summary: Get DataSample by ID
      description: Get DataSample by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of DataSample objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateDataSampleById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - samples
      summary: Update a sample
      description: Update the specified sample.<br/><br/>Provide a complete
        representation of the sample that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the sample.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated sample might not
        function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the sample file to update.
      requestBody:
        description: DataSample object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataSample"
            examples:
              UpdateSampleExamplesUpdateSample:
                $ref: "#/components/examples/UpdateSampleExamplesUpdateSample"
      responses:
        "200":
          description: The updated DataSample object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteDataSampleById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - samples
      summary: Delete DataSample
      description: Delete DataSample.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted DataSample object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/samples/{id}/content:
    get:
      operationId: getDataSampleContentById
      tags:
        - samples
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get sample content
      description: Get the specified sample.
      responses:
        "200":
          description: List of SampleContent objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSampleContent"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the sample to get.
        - name: alwaysReset
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, the Sampler should reset the
            <code>_time</code> attribute in each event to the current time.
            Otherwise, <code>false</code> (default).
  /p/{pack}/system/samples:
    get:
      operationId: getDataSampleSystemByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - samples
      summary: Get a list of DataSample objects within a Pack
      description: Get a list of DataSample objects within the specified Pack.
      responses:
        "200":
          description: List of DataSample objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.samples
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    post:
      operationId: createDataSampleSystemByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - samples
      summary: Create a data sample within a Pack
      description: Create a new data sample within the specified Pack.
      requestBody:
        description: DataSample object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataSample"
            examples:
              CreateSampleExamplesBasicSample:
                $ref: "#/components/examples/CreateSampleExamplesBasicSample"
      responses:
        "200":
          description: The created DataSample object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.samples
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/system/samples/{id}:
    get:
      operationId: getDataSampleSystemByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - samples
      summary: Get DataSample by ID within a Pack
      description: Get DataSample by ID within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: List of DataSample objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.samples
    patch:
      operationId: updateDataSampleSystemByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - samples
      summary: Update a sample within a Pack
      description: Update the specified sample.<br/><br/>Provide a complete
        representation of the sample that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the sample.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated sample might not
        function as expected within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the sample file to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: DataSample object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataSample"
            examples:
              UpdateSampleExamplesUpdateSample:
                $ref: "#/components/examples/UpdateSampleExamplesUpdateSample"
      responses:
        "200":
          description: The updated DataSample object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.samples
    delete:
      operationId: deleteDataSampleSystemByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - samples
      summary: Delete DataSample within a Pack
      description: Delete DataSample within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: The deleted DataSample object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.samples
  /p/{pack}/system/samples/{id}/content:
    get:
      operationId: getDataSampleSystemContentByPackAndId
      tags:
        - samples
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get sample content within a Pack
      description: Get the specified sample within the specified Pack.
      responses:
        "200":
          description: List of SampleContent objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSampleContent"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the sample to get.
        - name: alwaysReset
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, the Sampler should reset the
            <code>_time</code> attribute in each event to the current time.
            Otherwise, <code>false</code> (default).
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-group: packs.samples
  /search/dashboards:
    get:
      operationId: listSearchDashboard
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - dashboards
      summary: List all Dashboards
      description: Get a list of all Dashboards.
      responses:
        "200":
          description: List of SearchDashboard objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: datasetIds
          in: query
          required: false
          schema:
            type: array
            items:
              type: string
          description: List of <code>id</code> values for Datasets (maximum of 10). Limits
            the response to only Dashboards that reference the specified
            Datasets.
        - name: resolveDatasets
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, the response includes a
            <code>resolvedDatasetIds</code> array for each Dashboard that lists
            the <code>id</code> of each Dataset that the Dashboard references.
    post:
      operationId: createSearchDashboard
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - dashboards
      summary: Create a Dashboard
      description: Create a new Dashboard.
      requestBody:
        description: SearchDashboardInput object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SearchDashboardInput"
            examples:
              CreateDashboardExamplesSimpleDashboard:
                $ref: "#/components/examples/CreateDashboardExamplesSimpleDashboard"
      responses:
        "200":
          description: The created SearchDashboard object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/dashboards/{id}:
    get:
      operationId: getSearchDashboardById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - dashboards
      summary: Get a Dashboard
      description: Get the specified Dashboard.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard to get.
        - name: resolveDatasets
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, the response includes a
            <code>resolvedDatasetIds</code> array that lists the <code>id</code>
            of each Dataset that the Dashboard references.
      responses:
        "200":
          description: List of SearchDashboard objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSearchDashboardById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - dashboards
      summary: Update a Dashboard
      description: Update the specified Dashboard.<br/><br/>Provide a complete
        representation of the Dashboard that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Dashboard.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Dashboard might
        not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard to update.
      requestBody:
        description: SearchDashboardInput object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SearchDashboardInput"
            examples:
              UpdateDashboardExamplesUpdateDashboard:
                $ref: "#/components/examples/UpdateDashboardExamplesUpdateDashboard"
      responses:
        "200":
          description: The updated SearchDashboard object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteSearchDashboardById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - dashboards
      summary: Delete a Dashboard
      description: Delete the specified Dashboard.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard to delete.
      responses:
        "200":
          description: The deleted SearchDashboard object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/dashboards/{id}/acl:
    get:
      operationId: getSearchDashboardAclById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Get
      description: List accesses to SearchDashboard granted to users (Cribl.Cloud only).
      summary: Get SearchDashboard ACL (Cribl.Cloud only)
      tags:
        - dashboards
  /search/dashboards/{id}/acl/apply:
    post:
      operationId: createSearchDashboardAclApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclApplyDashboardExamplesGrantAccess:
                $ref: "#/components/examples/AclApplyDashboardExamplesGrantAccess"
              AclApplyDashboardExamplesRevokeAccess:
                $ref: "#/components/examples/AclApplyDashboardExamplesRevokeAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Create
      description: Add/remove accesses to SearchDashboard for users (Cribl.Cloud only).
      summary: Modify SearchDashboard ACL (Cribl.Cloud only)
      tags:
        - dashboards
  /search/dashboards/{id}/acl/teams:
    get:
      operationId: getSearchDashboardAclTeamsById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Get
      description: List accesses to SearchDashboard granted to Teams (Cribl.Cloud only).
      summary: Get SearchDashboard Teams (Cribl.Cloud only)
      tags:
        - dashboards
  /search/dashboards/{id}/acl/teams/apply:
    post:
      operationId: createSearchDashboardAclTeamsApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclTeamsApplyDashboardExamplesGrantTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyDashboardExamplesGrantTeamAccess"
              AclTeamsApplyDashboardExamplesRevokeTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyDashboardExamplesRevokeTeamAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Create
      description: Add/remove accesses to SearchDashboard for Teams (Cribl.Cloud only).
      summary: Modify SearchDashboard Teams ACL (Cribl.Cloud only)
      tags:
        - dashboards
  /search/dashboards/{id}/move:
    put:
      operationId: updateSearchDashboardMoveById
      tags:
        - dashboards
      x-speakeasy-name-override: move
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Move a Dashboard
      description: Move the specified Dashboard from the global context to a
        Pack.<br/><br/>To move a Dashboard from one Pack to another or from a
        Pack to the global context, use <code>PUT
        /p/{pack}/search/dashboards/{id}/move</code>.
      responses:
        "200":
          description: The updated SearchDashboard object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ContextMoveRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ContextMoveRequestBody"
            examples:
              MoveDashboardExamplesMoveToPack:
                $ref: "#/components/examples/MoveDashboardExamplesMoveToPack"
              MoveDashboardExamplesToGlobal:
                $ref: "#/components/examples/MoveDashboardExamplesToGlobal"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard to move.
  /p/{pack}/search/dashboards:
    get:
      operationId: getSearchDashboardSearchByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - dashboards
      summary: List all Dashboards within a Pack
      description: Get a list of all Dashboards within the specified Pack.
      responses:
        "200":
          description: List of SearchDashboard objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: datasetIds
          in: query
          required: false
          schema:
            type: array
            items:
              type: string
          description: List of <code>id</code> values for Datasets (maximum of 10). Limits
            the response to only Dashboards that reference the specified
            Datasets.
        - name: resolveDatasets
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, the response includes a
            <code>resolvedDatasetIds</code> array for each Dashboard that lists
            the <code>id</code> of each Dataset that the Dashboard references.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-group: packs.dashboards
    post:
      operationId: createSearchDashboardSearchByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - dashboards
      summary: Create a Dashboard within a Pack
      description: Create a new Dashboard within the specified Pack.
      requestBody:
        description: SearchDashboardInput object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SearchDashboardInput"
            examples:
              CreateDashboardExamplesSimpleDashboard:
                $ref: "#/components/examples/CreateDashboardExamplesSimpleDashboard"
      responses:
        "200":
          description: The created SearchDashboard object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.dashboards
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/search/dashboards/{id}:
    get:
      operationId: getSearchDashboardSearchByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - dashboards
      summary: Get a Dashboard within a Pack
      description: Get the specified Dashboard within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard to get.
        - name: resolveDatasets
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, the response includes a
            <code>resolvedDatasetIds</code> array that lists the <code>id</code>
            of each Dataset that the Dashboard references.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: List of SearchDashboard objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.dashboards
    patch:
      operationId: updateSearchDashboardSearchByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - dashboards
      summary: Update a Dashboard within a Pack
      description: Update the specified Dashboard.<br/><br/>Provide a complete
        representation of the Dashboard that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Dashboard.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Dashboard might
        not function as expected within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: SearchDashboardInput object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SearchDashboardInput"
            examples:
              UpdateDashboardExamplesUpdateDashboard:
                $ref: "#/components/examples/UpdateDashboardExamplesUpdateDashboard"
      responses:
        "200":
          description: The updated SearchDashboard object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.dashboards
    delete:
      operationId: deleteSearchDashboardSearchByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - dashboards
      summary: Delete a Dashboard within a Pack
      description: Delete the specified Dashboard within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: The deleted SearchDashboard object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.dashboards
  /p/{pack}/search/dashboards/{id}/acl:
    get:
      operationId: getSearchDashboardSearchAclByPackAndId
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Get
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      description: List accesses to SearchDashboard granted to users (Cribl.Cloud
        only) within the specified Pack.
      summary: Get SearchDashboard ACL (Cribl.Cloud only) within a Pack
      tags:
        - dashboards
      x-speakeasy-group: packs.dashboards
  /p/{pack}/search/dashboards/{id}/acl/apply:
    post:
      operationId: createSearchDashboardSearchAclApplyByPackAndId
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclApplyDashboardExamplesGrantAccess:
                $ref: "#/components/examples/AclApplyDashboardExamplesGrantAccess"
              AclApplyDashboardExamplesRevokeAccess:
                $ref: "#/components/examples/AclApplyDashboardExamplesRevokeAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Create
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      description: Add/remove accesses to SearchDashboard for users (Cribl.Cloud only)
        within the specified Pack.
      summary: Modify SearchDashboard ACL (Cribl.Cloud only) within a Pack
      tags:
        - dashboards
      x-speakeasy-group: packs.dashboards
  /p/{pack}/search/dashboards/{id}/acl/teams:
    get:
      operationId: getSearchDashboardSearchAclTeamsByPackAndId
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Get
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      description: List accesses to SearchDashboard granted to Teams (Cribl.Cloud
        only) within the specified Pack.
      summary: Get SearchDashboard Teams (Cribl.Cloud only) within a Pack
      tags:
        - dashboards
      x-speakeasy-group: packs.dashboards
  /p/{pack}/search/dashboards/{id}/acl/teams/apply:
    post:
      operationId: createSearchDashboardSearchAclTeamsApplyByPackAndId
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclTeamsApplyDashboardExamplesGrantTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyDashboardExamplesGrantTeamAccess"
              AclTeamsApplyDashboardExamplesRevokeTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyDashboardExamplesRevokeTeamAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Create
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      description: Add/remove accesses to SearchDashboard for Teams (Cribl.Cloud only)
        within the specified Pack.
      summary: Modify SearchDashboard Teams ACL (Cribl.Cloud only) within a Pack
      tags:
        - dashboards
      x-speakeasy-group: packs.dashboards
  /p/{pack}/search/dashboards/{id}/move:
    put:
      operationId: updateSearchDashboardSearchMoveByPackAndId
      tags:
        - dashboards
      x-speakeasy-name-override: move
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Move a Dashboard from a Pack
      description: Move the specified Dashboard from the specified Pack to another
        Pack or to the global context.<br/><br/>To move a Dashboard from the
        global context to a Pack, use <code>PUT
        /search/dashboards/{id}/move</code>.
      responses:
        "200":
          description: The updated SearchDashboard object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchDashboard"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ContextMoveRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ContextMoveRequestBody"
            examples:
              MoveDashboardExamplesMoveToPack:
                $ref: "#/components/examples/MoveDashboardExamplesMoveToPack"
              MoveDashboardExamplesToGlobal:
                $ref: "#/components/examples/MoveDashboardExamplesToGlobal"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard to move.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-group: packs.dashboards
  /search/macros:
    get:
      operationId: listSearchMacro
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: list
      tags:
        - macros
      summary: List all search Macros (Cribl.Cloud only)
      description: Get a list of all search Macros (Cribl.Cloud only).
      responses:
        "200":
          description: Search Macros
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.macros
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of search Macros to return in the response for this
            request. Use with <code>offset</code> to paginate the response into
            manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
    post:
      operationId: createSearchMacro
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: create
      tags:
        - macros
      summary: Create a search Macro (Cribl.Cloud only)
      description: Create a new search Macro (Cribl.Cloud only).
      requestBody:
        description: SearchMacro object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SearchMacro"
            examples:
              SearchMacroCreateExamplesMinimal:
                $ref: "#/components/examples/SearchMacroCreateExamplesMinimal"
              SearchMacroCreateExamplesFull:
                $ref: "#/components/examples/SearchMacroCreateExamplesFull"
              SearchMacroCreateExamplesParameterized:
                $ref: "#/components/examples/SearchMacroCreateExamplesParameterized"
      responses:
        "200":
          description: Created search Macro
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
              examples:
                SearchMacroListResponseExamplesMinimal:
                  $ref: "#/components/examples/SearchMacroListResponseExamplesMinimal"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.macros
  /search/macros/{id}:
    get:
      operationId: getSearchMacroById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: get
      tags:
        - macros
      summary: Get a search Macro (Cribl.Cloud only)
      description: Get the specified search Macro (Cribl.Cloud only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search Macro to get.
      responses:
        "200":
          description: The requested search Macro
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
              examples:
                SearchMacroListResponseExamplesMinimal:
                  $ref: "#/components/examples/SearchMacroListResponseExamplesMinimal"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.macros
    patch:
      operationId: updateSearchMacroById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: update
      tags:
        - macros
      summary: Update a search Macro (Cribl.Cloud only)
      description: Update the specified search Macro (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the search Macro
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the search Macro.<br/><br/>Confirm that the configuration in your
        request body is correct before sending the request. If the configuration
        is incorrect, the updated search Macro might not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search Macro to update.
      requestBody:
        description: SearchMacro object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SearchMacro"
            examples:
              SearchMacroUpdateExamplesMinimal:
                $ref: "#/components/examples/SearchMacroUpdateExamplesMinimal"
              SearchMacroUpdateExamplesUpdateDefinition:
                $ref: "#/components/examples/SearchMacroUpdateExamplesUpdateDefinition"
      responses:
        "200":
          description: Updated search Macro
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
              examples:
                SearchMacroListResponseExamplesMinimal:
                  $ref: "#/components/examples/SearchMacroListResponseExamplesMinimal"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.macros
    delete:
      operationId: deleteSearchMacroById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: delete
      tags:
        - macros
      summary: Delete a search Macro (Cribl.Cloud only)
      description: Delete the specified search Macro (Cribl.Cloud only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search Macro to delete.
      responses:
        "200":
          description: Deleted search Macro
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
              examples:
                SearchMacroListResponseExamplesMinimal:
                  $ref: "#/components/examples/SearchMacroListResponseExamplesMinimal"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.macros
  /search/macros/{id}/move:
    put:
      operationId: updateSearchMacroMoveById
      tags:
        - macros
      x-speakeasy-group: search.macros
      x-speakeasy-name-override: move
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Move a search Macro (Cribl.Cloud only)
      description: Move the specified search Macro from the global context into a Pack
        (Cribl.Cloud only).<br/><br/>To move a search Macro from one Pack to
        another or from a Pack to the global context, use <code>PUT
        /p/{pack}/search/macros/{id}/move</code>.
      responses:
        "200":
          description: Moved search Macro
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
              examples:
                SearchMacroListResponseExamplesMinimal:
                  $ref: "#/components/examples/SearchMacroListResponseExamplesMinimal"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ContextMoveRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ContextMoveRequestBody"
            examples:
              MoveMacroContextExamplesIntoPack:
                $ref: "#/components/examples/MoveMacroContextExamplesIntoPack"
              MoveMacroContextExamplesToGlobal:
                $ref: "#/components/examples/MoveMacroContextExamplesToGlobal"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search Macro to move.
  /p/{pack}/search/macros:
    get:
      operationId: getSearchMacroSearchByPack
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: list
      tags:
        - macros
      summary: List all search Macros (Cribl.Cloud only) within a Pack
      description: Get a list of all search Macros (Cribl.Cloud only) within the
        specified Pack.
      responses:
        "200":
          description: Search Macros
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.search.macros
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of search Macros to return in the response for this
            request. Use with <code>offset</code> to paginate the response into
            manageable batches.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
    post:
      operationId: createSearchMacroSearchByPack
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: create
      tags:
        - macros
      summary: Create a search Macro (Cribl.Cloud only) within a Pack
      description: Create a new search Macro (Cribl.Cloud only) within the specified Pack.
      requestBody:
        description: SearchMacro object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SearchMacro"
            examples:
              SearchMacroCreateExamplesMinimal:
                $ref: "#/components/examples/SearchMacroCreateExamplesMinimal"
              SearchMacroCreateExamplesFull:
                $ref: "#/components/examples/SearchMacroCreateExamplesFull"
              SearchMacroCreateExamplesParameterized:
                $ref: "#/components/examples/SearchMacroCreateExamplesParameterized"
      responses:
        "200":
          description: Created search Macro
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
              examples:
                SearchMacroListResponseExamplesMinimal:
                  $ref: "#/components/examples/SearchMacroListResponseExamplesMinimal"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.search.macros
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/search/macros/{id}:
    get:
      operationId: getSearchMacroSearchByPackAndId
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: get
      tags:
        - macros
      summary: Get a search Macro (Cribl.Cloud only) within a Pack
      description: Get the specified search Macro (Cribl.Cloud only) within the
        specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search Macro to get.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: The requested search Macro
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
              examples:
                SearchMacroListResponseExamplesMinimal:
                  $ref: "#/components/examples/SearchMacroListResponseExamplesMinimal"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.search.macros
    patch:
      operationId: updateSearchMacroSearchByPackAndId
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: update
      tags:
        - macros
      summary: Update a search Macro (Cribl.Cloud only) within a Pack
      description: Update the specified search Macro (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the search Macro
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the search Macro.<br/><br/>Confirm that the configuration in your
        request body is correct before sending the request. If the configuration
        is incorrect, the updated search Macro might not function as expected
        within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search Macro to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: SearchMacro object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SearchMacro"
            examples:
              SearchMacroUpdateExamplesMinimal:
                $ref: "#/components/examples/SearchMacroUpdateExamplesMinimal"
              SearchMacroUpdateExamplesUpdateDefinition:
                $ref: "#/components/examples/SearchMacroUpdateExamplesUpdateDefinition"
      responses:
        "200":
          description: Updated search Macro
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
              examples:
                SearchMacroListResponseExamplesMinimal:
                  $ref: "#/components/examples/SearchMacroListResponseExamplesMinimal"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.search.macros
    delete:
      operationId: deleteSearchMacroSearchByPackAndId
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: delete
      tags:
        - macros
      summary: Delete a search Macro (Cribl.Cloud only) within a Pack
      description: Delete the specified search Macro (Cribl.Cloud only) within the
        specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search Macro to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: Deleted search Macro
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
              examples:
                SearchMacroListResponseExamplesMinimal:
                  $ref: "#/components/examples/SearchMacroListResponseExamplesMinimal"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.search.macros
  /p/{pack}/search/macros/{id}/move:
    put:
      operationId: updateSearchMacroSearchMoveByPackAndId
      tags:
        - macros
      x-speakeasy-group: packs.search.macros
      x-speakeasy-name-override: move
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Move a search Macro from a Pack
      description: Move the specified search Macro from the given Pack to another Pack
        or to the global context.<br/><br/>To move a search Macro from the
        global context into a Pack, use <code>PUT
        /search/macros/{id}/move</code>.
      responses:
        "200":
          description: Moved search Macro
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMacro"
              examples:
                SearchMacroListResponseExamplesMinimal:
                  $ref: "#/components/examples/SearchMacroListResponseExamplesMinimal"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ContextMoveRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ContextMoveRequestBody"
            examples:
              MoveMacroContextExamplesIntoPack:
                $ref: "#/components/examples/MoveMacroContextExamplesIntoPack"
              MoveMacroContextExamplesToGlobal:
                $ref: "#/components/examples/MoveMacroContextExamplesToGlobal"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search Macro to move.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /search/notebook-templates:
    get:
      operationId: listNotebookTemplate
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - notebook-templates
      summary: List all Notebook templates
      description: Get a list of all Notebook templates.
      responses:
        "200":
          description: List of NotebookTemplate objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebookTemplate"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createNotebookTemplate
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - notebook-templates
      summary: Create a Notebook template
      description: Create a new Notebook template.
      requestBody:
        description: NotebookTemplateInput object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/NotebookTemplateInput"
            examples:
              CreateNotebookTemplateExamplesSimpleTemplate:
                $ref: "#/components/examples/CreateNotebookTemplateExamplesSimpleTemplate"
      responses:
        "200":
          description: The created NotebookTemplate object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebookTemplate"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/notebook-templates/{id}:
    get:
      operationId: getNotebookTemplateById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - notebook-templates
      summary: Get a Notebook template
      description: Get the specified Notebook template.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notebook template to get.
      responses:
        "200":
          description: List of NotebookTemplate objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebookTemplate"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Notebook template not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateNotebookTemplateById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - notebook-templates
      summary: Update a Notebook template
      description: Update the specified Notebook template.<br/><br/>Provide a complete
        representation of the Notebook template that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Notebook
        template.<br/><br/>Confirm that the configuration in your request body
        is correct before sending the request. If the configuration is
        incorrect, the updated Notebook template might not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notebook template to update.
      requestBody:
        description: NotebookTemplateInput object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/NotebookTemplateInput"
            examples:
              UpdateNotebookTemplateExamplesUpdateTemplate:
                $ref: "#/components/examples/UpdateNotebookTemplateExamplesUpdateTemplate"
      responses:
        "200":
          description: The updated NotebookTemplate object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebookTemplate"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Notebook template not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteNotebookTemplateById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - notebook-templates
      summary: Delete a Notebook template
      description: Delete the specified Notebook template.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notebook template to delete.
      responses:
        "200":
          description: The deleted NotebookTemplate object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebookTemplate"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/notebook-templates/{id}/acl:
    get:
      operationId: getNotebookTemplateAclById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Get
      description: List accesses to NotebookTemplate granted to users (Cribl.Cloud only).
      summary: Get NotebookTemplate ACL (Cribl.Cloud only)
      tags:
        - notebook-templates
  /search/notebook-templates/{id}/acl/apply:
    post:
      operationId: createNotebookTemplateAclApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclApplyNotebookTemplateExamplesGrantAccess:
                $ref: "#/components/examples/AclApplyNotebookTemplateExamplesGrantAccess"
              AclApplyNotebookTemplateExamplesRevokeAccess:
                $ref: "#/components/examples/AclApplyNotebookTemplateExamplesRevokeAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Create
      description: Add/remove accesses to NotebookTemplate for users (Cribl.Cloud only).
      summary: Modify NotebookTemplate ACL (Cribl.Cloud only)
      tags:
        - notebook-templates
  /search/notebook-templates/{id}/acl/teams:
    get:
      operationId: getNotebookTemplateAclTeamsById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Get
      description: List accesses to NotebookTemplate granted to Teams (Cribl.Cloud only).
      summary: Get NotebookTemplate Teams (Cribl.Cloud only)
      tags:
        - notebook-templates
  /search/notebook-templates/{id}/acl/teams/apply:
    post:
      operationId: createNotebookTemplateAclTeamsApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclTeamsApplyNotebookTemplateExamplesGrantTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyNotebookTemplateExamplesGrantTeamAcce\
                  ss"
              AclTeamsApplyNotebookTemplateExamplesRevokeTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyNotebookTemplateExamplesRevokeTeamAcc\
                  ess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Create
      description: Add/remove accesses to NotebookTemplate for Teams (Cribl.Cloud only).
      summary: Modify NotebookTemplate Teams ACL (Cribl.Cloud only)
      tags:
        - notebook-templates
  /search/saved:
    get:
      operationId: listSavedQuery
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: list
      tags:
        - savedQueries
      summary: List saved searches (Cribl.Cloud only)
      description: Get a list of saved searches (Cribl.Cloud only).
      responses:
        "200":
          description: Saved searches
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedQuery"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.savedQueries
      parameters:
        - name: resolveDatasets
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include resolved Dataset identifiers on each
            saved search.
        - name: datasetIds
          in: query
          required: false
          schema:
            type: array
            items:
              type: string
          description: Return only saved searches associated with any of the listed
            Dataset IDs (maximum 10).
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of saved searches to return in the response for this
            request. Use with <code>offset</code> to paginate the response into
            manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
    post:
      operationId: createSavedQuery
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: create
      tags:
        - savedQueries
      summary: Create a saved search (Cribl.Cloud only)
      description: Create a new saved search (Cribl.Cloud only).
      requestBody:
        description: SavedQuery object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SavedQuery"
            examples:
              SavedQueryCreateExamplesMinimal:
                $ref: "#/components/examples/SavedQueryCreateExamplesMinimal"
              SavedQueryCreateExamplesWithTimeRangeAndDescription:
                $ref: "#/components/examples/SavedQueryCreateExamplesWithTimeRangeAndDescriptio\
                  n"
              SavedQueryCreateExamplesWithSchedule:
                $ref: "#/components/examples/SavedQueryCreateExamplesWithSchedule"
      responses:
        "200":
          description: The created saved search.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedQuery"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.savedQueries
  /search/saved/{id}:
    get:
      operationId: getSavedQueryById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: get
      tags:
        - savedQueries
      summary: Get a saved search (Cribl.Cloud only)
      description: Get the specified saved search (Cribl.Cloud only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search to get.
      responses:
        "200":
          description: The requested saved search
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedQuery"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Saved search not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.savedQueries
    patch:
      operationId: updateSavedQueryById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: update
      tags:
        - savedQueries
      summary: Update a saved search (Cribl.Cloud only)
      description: Update the specified saved search (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the saved search
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the saved search.<br/><br/>Confirm that the configuration in your
        request body is correct before sending the request. If the configuration
        is incorrect, the updated saved search might not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search to update.
      requestBody:
        description: SavedQuery object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SavedQuery"
            examples:
              SavedQueryUpdateExamplesFull:
                $ref: "#/components/examples/SavedQueryUpdateExamplesFull"
              SavedQueryUpdateExamplesTogglePrivacy:
                $ref: "#/components/examples/SavedQueryUpdateExamplesTogglePrivacy"
      responses:
        "200":
          description: Updated saved search
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedQuery"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.savedQueries
    delete:
      operationId: deleteSavedQueryById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: delete
      tags:
        - savedQueries
      summary: Delete a saved search (Cribl.Cloud only)
      description: Delete the specified saved search (Cribl.Cloud
        only).<br/><br/>Removes scheduled Notifications associated with the
        saved search.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search to delete.
      responses:
        "200":
          description: The deleted saved search
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedQuery"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.savedQueries
  /search/saved/{id}/move:
    put:
      operationId: updateSavedQueryMoveById
      tags:
        - savedQueries
      x-speakeasy-group: search.savedQueries
      x-speakeasy-name-override: move
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Move a saved search (Cribl.Cloud only)
      description: Move the specified saved search from the global context into a Pack
        (Cribl.Cloud only).<br/><br/>To move a saved search from one Pack to
        another or from a Pack to the global context, use <code>PUT
        /p/{pack}/search/saved/{id}/move</code>.
      responses:
        "200":
          description: The saved search after the move
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ContextMoveRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ContextMoveRequestBody"
            examples:
              MoveSavedQueryContextExamplesIntoPack:
                $ref: "#/components/examples/MoveSavedQueryContextExamplesIntoPack"
              MoveSavedQueryContextExamplesToGlobal:
                $ref: "#/components/examples/MoveSavedQueryContextExamplesToGlobal"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search to move.
  /search/saved/{id}/notifications:
    post:
      operationId: createSavedQueryNotificationsById
      tags:
        - savedQueries
      x-speakeasy-group: search.savedQueries
      x-speakeasy-name-override: createNotification
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Create a Notification (Cribl.Cloud only)
      description: Create a Notification for the specified saved search (Cribl.Cloud only).
      responses:
        "201":
          description: Created notifications
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
              examples:
                SavedQueryNotificationResponseExamplesEmail:
                  $ref: "#/components/examples/SavedQueryNotificationResponseExamplesEmail"
        "400":
          description: Invalid notification configuration or validation failure.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Only the owner or administrator can create notifications for this
            saved search.
        "404":
          description: Saved search not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: Notification object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Notification"
            examples:
              SavedQueryNotificationCreateExamplesEmail:
                $ref: "#/components/examples/SavedQueryNotificationCreateExamplesEmail"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search.
  /search/saved/{id}/notifications/{notificationId}:
    delete:
      operationId: deleteSavedQueryNotificationsByIdAndNotificationId
      tags:
        - savedQueries
      x-speakeasy-group: search.savedQueries
      x-speakeasy-name-override: deleteNotification
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete a Notification (Cribl.Cloud only)
      description: Delete the specified Notification for a saved search (Cribl.Cloud only).
      responses:
        "200":
          description: Remaining notifications after delete
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
              examples:
                SavedQueryNotificationResponseExamplesEmail:
                  $ref: "#/components/examples/SavedQueryNotificationResponseExamplesEmail"
        "400":
          description: Invalid request or notification operation failed.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Only the owner or administrator can delete notifications for this
            saved search.
        "404":
          description: Saved search not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search.
        - name: notificationId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notification.
    patch:
      operationId: updateSavedQueryNotificationsByIdAndNotificationId
      tags:
        - savedQueries
      x-speakeasy-group: search.savedQueries
      x-speakeasy-name-override: updateNotification
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update a Notification (Cribl.Cloud only)
      description: Update the specified Notification for a saved search (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the Notification
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the Notification.<br/><br/>Confirm that the configuration in your
        request body is correct before sending the request. If the configuration
        is incorrect, the updated Notification might not function as expected.
      responses:
        "200":
          description: Updated notifications
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
              examples:
                SavedQueryNotificationResponseExamplesEmail:
                  $ref: "#/components/examples/SavedQueryNotificationResponseExamplesEmail"
        "400":
          description: Invalid notification configuration or validation failure.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Only the owner or administrator can update notifications for this
            saved search.
        "404":
          description: Saved search or notification not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: Notification object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Notification"
            examples:
              SavedQueryNotificationUpdateExamplesPartial:
                $ref: "#/components/examples/SavedQueryNotificationUpdateExamplesPartial"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search.
        - name: notificationId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notification.
  /p/{pack}/search/saved:
    post:
      operationId: createSavedQuerySearchSavedByPack
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: create
      tags:
        - savedQueries
      summary: Create a saved search (Cribl.Cloud only) within a Pack
      description: Create a new saved search (Cribl.Cloud only) within the specified Pack.
      requestBody:
        description: SavedQuery object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SavedQuery"
            examples:
              SavedQueryCreateExamplesMinimal:
                $ref: "#/components/examples/SavedQueryCreateExamplesMinimal"
              SavedQueryCreateExamplesWithTimeRangeAndDescription:
                $ref: "#/components/examples/SavedQueryCreateExamplesWithTimeRangeAndDescriptio\
                  n"
              SavedQueryCreateExamplesWithSchedule:
                $ref: "#/components/examples/SavedQueryCreateExamplesWithSchedule"
      responses:
        "200":
          description: The created saved search.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedQuery"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.search.savedQueries
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getSavedQuerySearchSavedByPack
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: list
      tags:
        - savedQueries
      summary: List saved searches (Cribl.Cloud only) within a Pack
      description: Get a list of saved searches (Cribl.Cloud only) within the
        specified Pack.
      responses:
        "200":
          description: Saved searches
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedQuery"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.search.savedQueries
      parameters:
        - name: resolveDatasets
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include resolved Dataset identifiers on each
            saved search.
        - name: datasetIds
          in: query
          required: false
          schema:
            type: array
            items:
              type: string
          description: Return only saved searches associated with any of the listed
            Dataset IDs (maximum 10).
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of saved searches to return in the response for this
            request. Use with <code>offset</code> to paginate the response into
            manageable batches.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /p/{pack}/search/saved/{id}:
    delete:
      operationId: deleteSavedQuerySearchSavedByPackAndId
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: delete
      tags:
        - savedQueries
      summary: Delete a saved search (Cribl.Cloud only) within a Pack
      description: Delete the specified saved search (Cribl.Cloud
        only).<br/><br/>Removes scheduled Notifications associated with the
        saved search within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: The deleted saved search
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedQuery"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.search.savedQueries
    get:
      operationId: getSavedQuerySearchSavedByPackAndId
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: get
      tags:
        - savedQueries
      summary: Get a saved search (Cribl.Cloud only) within a Pack
      description: Get the specified saved search (Cribl.Cloud only) within the
        specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search to get.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: The requested saved search
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedQuery"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Saved search not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.search.savedQueries
    patch:
      operationId: updateSavedQuerySearchSavedByPackAndId
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: update
      tags:
        - savedQueries
      summary: Update a saved search (Cribl.Cloud only) within a Pack
      description: Update the specified saved search (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the saved search
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the saved search.<br/><br/>Confirm that the configuration in your
        request body is correct before sending the request. If the configuration
        is incorrect, the updated saved search might not function as expected
        within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: SavedQuery object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SavedQuery"
            examples:
              SavedQueryUpdateExamplesFull:
                $ref: "#/components/examples/SavedQueryUpdateExamplesFull"
              SavedQueryUpdateExamplesTogglePrivacy:
                $ref: "#/components/examples/SavedQueryUpdateExamplesTogglePrivacy"
      responses:
        "200":
          description: Updated saved search
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSavedQuery"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.search.savedQueries
  /p/{pack}/search/saved/{id}/move:
    put:
      operationId: updateSavedQuerySearchSavedMoveByPackAndId
      tags:
        - savedQueries
      x-speakeasy-group: packs.search.savedQueries
      x-speakeasy-name-override: move
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Move a saved search from a Pack
      description: Move the specified saved search from the given Pack to another Pack
        or to the global context.<br/><br/>To move a saved search from the
        global context into a Pack, use <code>PUT
        /search/saved/{id}/move</code>.
      responses:
        "200":
          description: The saved search after the move
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ContextMoveRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ContextMoveRequestBody"
            examples:
              MoveSavedQueryContextExamplesIntoPack:
                $ref: "#/components/examples/MoveSavedQueryContextExamplesIntoPack"
              MoveSavedQueryContextExamplesToGlobal:
                $ref: "#/components/examples/MoveSavedQueryContextExamplesToGlobal"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the saved search to move.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /search/jobs:
    get:
      operationId: listSearchJob
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: list
      tags:
        - search
      summary: List all search jobs (Cribl.Cloud only)
      description: Get a list of all search jobs (Cribl.Cloud only). Supports
        filtering, sorting, and pagination.
      responses:
        "200":
          description: Matching search jobs or abbreviated rows when
            <code>output=short</code>
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchJob"
              examples:
                SearchJobListResponseExamplesFullJobRow:
                  $ref: "#/components/examples/SearchJobListResponseExamplesFullJobRow"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: output
          in: query
          required: false
          schema:
            type: string
          description: Output format. Use <code>short</code> to return abbreviated job
            information.
        - name: id
          in: query
          required: false
          schema:
            type: array
            items:
              type: string
          description: Filter by job IDs. Can specify multiple IDs.
        - name: earliest
          in: query
          required: false
          schema:
            type: string
          description: Filter jobs by earliest time.
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/SearchJobType"
          description: Filter by job type.
        - name: sortExp
          in: query
          required: false
          schema:
            type: string
          description: Sorting expression to evaluate against jobs to specify the sort
            order.
        - name: sortDir
          in: query
          required: false
          schema:
            type: string
          description: Sort direction. Use <code>asc</code> or <code>desc</code>. Defaults
            to <code>asc</code>.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of jobs to return. Use with <code>offset</code> to
            paginate results.
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results. Use with
            <code>limit</code> to paginate results.
        - name: latest
          in: query
          required: false
          schema:
            type: string
          description: Filter jobs by latest time. Used when <code>output=short</code>.
        - name: correlationId
          in: query
          required: false
          schema:
            type: string
          description: Filter by correlation ID. Used when <code>output=short</code>.
        - name: groupByCorrelationId
          in: query
          required: false
          schema:
            type: boolean
          description: Group scheduled searches by correlation ID. Used when
            <code>output=short</code>.
        - name: filterExp
          in: query
          required: false
          schema:
            type: string
          description: Filter expression to evaluate against jobs for inclusion in the
            response. Used when <code>output=short</code>.
        - name: totalEventCount
          in: query
          required: false
          schema:
            type: boolean
          description: Include total event count in response. Used when
            <code>output=short</code>.
        - name: includeSavedQueryNames
          in: query
          required: false
          schema:
            type: boolean
          description: Include saved query names in response. Used when
            <code>output=short</code>.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
    post:
      operationId: createSearchJob
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: create
      tags:
        - search
      summary: Create a search job (Cribl.Cloud only)
      description: Create a new search job to execute a Cribl search query
        (Cribl.Cloud only).
      requestBody:
        description: CreateSearchJobSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CreateSearchJobSchema"
            examples:
              SearchJobCreateExamplesMinimal:
                $ref: "#/components/examples/SearchJobCreateExamplesMinimal"
              SearchJobCreateExamplesWithTimeRange:
                $ref: "#/components/examples/SearchJobCreateExamplesWithTimeRange"
              SearchJobCreateExamplesEventContext:
                $ref: "#/components/examples/SearchJobCreateExamplesEventContext"
      responses:
        "200":
          description: A list containing the created search job object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchJob"
              examples:
                SearchJobCreateResponseExamplesSyntheticCompleted:
                  $ref: "#/components/examples/SearchJobCreateResponseExamplesSyntheticCompleted"
        "400":
          description: Invalid query or request validation failure.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "429":
          description: Search limit or concurrency guardrail exceeded.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/jobs/{id}:
    get:
      operationId: getSearchJobById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: get
      tags:
        - search
      summary: Get a search job (Cribl.Cloud only)
      description: Get the specified search job (Cribl.Cloud only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job to get.
      responses:
        "200":
          description: The requested search job
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchJob"
              examples:
                SearchJobCreateResponseExamplesSyntheticCompleted:
                  $ref: "#/components/examples/SearchJobCreateResponseExamplesSyntheticCompleted"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSearchJobById
      x-cribl-internal: true
      x-cribl-availability: cloud
      x-speakeasy-name-override: update
      tags:
        - search
      summary: Update a search job (Cribl.Cloud only)
      description: Update the specified search job (Cribl.Cloud only). Only the
        <code>status</code> and <code>isPrivate</code> fields are mutable.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job to update.
      requestBody:
        description: UpdateSearchJobSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateSearchJobSchema"
            examples:
              SearchJobUpdateExamplesCancel:
                $ref: "#/components/examples/SearchJobUpdateExamplesCancel"
              SearchJobUpdateExamplesMakeResultsPublic:
                $ref: "#/components/examples/SearchJobUpdateExamplesMakeResultsPublic"
      responses:
        "200":
          description: A list containing the updated search job object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchJob"
              examples:
                SearchJobCreateResponseExamplesSyntheticCompleted:
                  $ref: "#/components/examples/SearchJobCreateResponseExamplesSyntheticCompleted"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Search job not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteSearchJobById
      x-cribl-internal: true
      x-cribl-availability: cloud
      x-speakeasy-name-override: delete
      tags:
        - search
      summary: Delete a search job (Cribl.Cloud only)
      description: Delete the specified search job (Cribl.Cloud only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job to delete.
      responses:
        "200":
          description: Deleted job records
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchJob"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/jobs/{id}/cancel:
    post:
      operationId: createSearchJobCancelById
      tags:
        - search
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Cancel a search job (Cribl.Cloud only)
      description: Cancel the specified search job (Cribl.Cloud only).
      responses:
        "200":
          description: Updated job records after cancel is accepted
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchJob"
              examples:
                SearchJobCancelResponseExamplesCanceled:
                  $ref: "#/components/examples/SearchJobCancelResponseExamplesCanceled"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job to cancel.
  /search/jobs/{id}/dispatch-executors:
    post:
      operationId: createSearchJobDispatchExecutorsById
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Dispatch executors for a search job (Cribl.Cloud only)
      description: Dispatch the specified search job to compute executors for
        execution (Cribl.Cloud only). Reserved for internal coordinator use.
      responses:
        "200":
          description: Allocation results in the standard API list envelope
            (<code>items</code>, <code>count</code>, and optional
            <code>offset</code>, <code>limit</code>, <code>totalCount</code>).
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAllocateResult"
        "400":
          description: Request must include dataset IDs or queue and compute provider
            identifiers.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Search job not found.
        "409":
          description: Search job is not in a dispatchable state.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job.
  /search/jobs/{id}/settings:
    get:
      operationId: getSearchJobSettingsById
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Get search job settings (Cribl.Cloud only)
      description: Get the settings for the specified search job (Cribl.Cloud only).
        Returns an empty object when no custom settings exist.
      responses:
        "200":
          description: The search job settings object
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SearchJobSettings"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Search job not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job.
    post:
      operationId: createSearchJobSettingsById
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Update search job settings (Cribl.Cloud only)
      description: Update settings for the specified search job (Cribl.Cloud only).
        Overwrites any existing settings.
      responses:
        "200":
          description: The saved settings body
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SearchJobSettings"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Search job not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SearchJobSettings object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SearchJobSettings"
            examples:
              SearchJobSettingsExamplesExtendRetention:
                $ref: "#/components/examples/SearchJobSettingsExamplesExtendRetention"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job.
  /search/jobs/{id}/status:
    get:
      operationId: getSearchJobStatusById
      tags:
        - search
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get search job status (Cribl.Cloud only)
      description: Get execution status details for the specified search job
        (Cribl.Cloud only).
      responses:
        "200":
          description: Search job status payload
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/StatusResponse"
              examples:
                SearchJobStatusResponseExamplesRunning:
                  $ref: "#/components/examples/SearchJobStatusResponseExamplesRunning"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Search job not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job.
        - name: advanced
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include stage-level details, ingestion
            metrics, and object filter statistics in the response in the
            response.
  /search/jobs/{id}/timeline:
    get:
      operationId: getSearchJobTimelineById
      tags:
        - search
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get search job timeline (Cribl.Cloud only)
      description: Get the event timeline for the specified search job (Cribl.Cloud
        only). Returns time-bucketed event counts and a total event count.
      responses:
        "200":
          description: Timeline JSON payload
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SearchTimeline"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Search job not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job.
  /search/jobs/{id}/field-summaries:
    get:
      operationId: getSearchJobFieldSummariesById
      tags:
        - search
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get field summaries for a search job (Cribl.Cloud only)
      description: Get field summaries (aggregated field metadata) for the specified
        search job (Cribl.Cloud only).
      responses:
        "200":
          description: Field summary JSON payload
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/FieldSummaries"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Search job not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job.
  /search/jobs/{id}/logs:
    get:
      operationId: getSearchJobLogsById
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: List log files for a search job (Cribl.Cloud only)
      description: List the available log files for the specified search job
        (Cribl.Cloud only). Use <code>GET
        /search/jobs/{id}/logs/{filename}</code> to download a specific log
        file.
      responses:
        "200":
          description: Available log filenames
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job.
  /products/aetos/config-profiles:
    get:
      operationId: listMonitorConfigProfile
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - configProfiles
      summary: Get a list of MonitorConfigProfile objects
      description: Get a list of MonitorConfigProfile objects.
      responses:
        "200":
          description: List of MonitorConfigProfile objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConfigProfile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createMonitorConfigProfile
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - configProfiles
      summary: Create MonitorConfigProfile
      description: Create MonitorConfigProfile.
      requestBody:
        description: New MonitorConfigProfile object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MonitorConfigProfile"
      responses:
        "200":
          description: The created MonitorConfigProfile object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConfigProfile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /products/aetos/config-profiles/{id}:
    get:
      operationId: getMonitorConfigProfileById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - configProfiles
      summary: Get MonitorConfigProfile by ID
      description: Get MonitorConfigProfile by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of MonitorConfigProfile objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConfigProfile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateMonitorConfigProfileById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - configProfiles
      summary: Update MonitorConfigProfile
      description: Update MonitorConfigProfile.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to PATCH
      requestBody:
        description: MonitorConfigProfile object to be updated.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MonitorConfigProfile"
      responses:
        "200":
          description: The updated MonitorConfigProfile object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConfigProfile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteMonitorConfigProfileById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - configProfiles
      summary: Delete MonitorConfigProfile
      description: Delete MonitorConfigProfile.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted MonitorConfigProfile object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConfigProfile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /products/aetos/config-profiles/{id}/configs:
    post:
      operationId: createMonitorConfigProfileConfigsById
      tags:
        - configProfiles
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Attach a SharedConfig to a profile
      description: Attach the specified SharedConfig to this profile.<br/><br/>A
        SharedConfig can appear at most once per tree. If the specified
        SharedConfig already exists in this profile's tree, the request fails.
      responses:
        "200":
          description: The updated profile with the new config attached.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConfigProfile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AttachConfigRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AttachConfigRequest"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the config profile.
  /products/aetos/config-profiles/{id}/configs/{configId}:
    delete:
      operationId: deleteMonitorConfigProfileConfigsByIdAndConfigId
      tags:
        - configProfiles
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Detach a SharedConfig from a profile
      description: Remove the specified SharedConfig from this profile.
      responses:
        "200":
          description: The updated profile with the config detached.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConfigProfile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the config profile.
        - name: configId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the SharedConfig to detach.
  /products/aetos/config-profiles/{id}/resolved:
    get:
      operationId: getMonitorConfigProfileResolvedById
      tags:
        - configProfiles
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Resolve effective config for a profile
      description: Resolve the effective configuration for this profile by merging
        SharedConfigs from the root to this profile.<br/><br/>Child values
        override parent values on a per-key basis.
      responses:
        "200":
          description: The merged effective configuration.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedObject"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the profile to resolve.
  /products/aetos/config-profiles/{id}/link:
    post:
      operationId: createMonitorConfigProfileLinkById
      tags:
        - configProfiles
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Link a profile under a parent
      description: Link this profile as a child of the specified parent.<br/><br/>The
        operation validates that the resulting tree is acyclic, does not exceed
        a maximum depth of 4, and contains no duplicate SharedConfigs across
        parent and child trees.
      responses:
        "200":
          description: The updated child profile after linking.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConfigProfile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LinkProfileRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LinkProfileRequest"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the child profile to link.
  /products/aetos/config-profiles/{id}/unlink:
    post:
      operationId: createMonitorConfigProfileUnlinkById
      tags:
        - configProfiles
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Unlink a profile from its parent
      description: Remove the parent relationship from this profile, making it a new
        tree root.<br/><br/>The subtree rooted at this profile splits off into
        its own tree. Both the original and new trees update their assigned
        configs accordingly.
      responses:
        "200":
          description: The updated profile after unlinking (now a root).
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConfigProfile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the profile to unlink.
  /products/aetos/monitors:
    get:
      operationId: listMonitorConf
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - monitors
      summary: Get a list of MonitorConf objects
      description: Get a list of MonitorConf objects.
      responses:
        "200":
          description: List of MonitorConf objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConf"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createMonitorConf
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - monitors
      summary: Create MonitorConf
      description: Create MonitorConf.
      requestBody:
        description: New MonitorConf object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MonitorConf"
      responses:
        "200":
          description: The created MonitorConf object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConf"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /products/aetos/monitors/{id}:
    get:
      operationId: getMonitorConfById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - monitors
      summary: Get MonitorConf by ID
      description: Get MonitorConf by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of MonitorConf objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConf"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateMonitorConfById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - monitors
      summary: Update MonitorConf
      description: Update MonitorConf.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to PATCH
      requestBody:
        description: MonitorConf object to be updated.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MonitorConf"
      responses:
        "200":
          description: The updated MonitorConf object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConf"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteMonitorConfById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - monitors
      summary: Delete MonitorConf
      description: Delete MonitorConf.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted MonitorConf object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMonitorConf"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /products/aetos/shared-configs:
    get:
      operationId: listSharedConfig
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - sharedConfigs
      summary: Get a list of SharedConfig objects
      description: Get a list of SharedConfig objects.
      responses:
        "200":
          description: List of SharedConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSharedConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createSharedConfig
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - sharedConfigs
      summary: Create SharedConfig
      description: Create SharedConfig.
      requestBody:
        description: New SharedConfig object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SharedConfig"
      responses:
        "200":
          description: The created SharedConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSharedConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /products/aetos/shared-configs/{id}:
    get:
      operationId: getSharedConfigById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - sharedConfigs
      summary: Get SharedConfig by ID
      description: Get SharedConfig by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of SharedConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSharedConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSharedConfigById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - sharedConfigs
      summary: Update SharedConfig
      description: Update SharedConfig.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to PATCH
      requestBody:
        description: SharedConfig object to be updated.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SharedConfig"
      responses:
        "200":
          description: The updated SharedConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSharedConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteSharedConfigById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - sharedConfigs
      summary: Delete a SharedConfig
      description: Delete the specified SharedConfig.<br/><br/>Rejected if any config
        profile still references this SharedConfig. Detach from all profiles
        first.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the SharedConfig to delete.
      responses:
        "200":
          description: The deleted SharedConfig.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSharedConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/banners:
    post:
      operationId: createBannerMessage
      tags:
        - banners
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Banner
      description: Create a new Banner.
      responses:
        "200":
          description: The created BannerMessage object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBannerMessage"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: BannerMessage object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/BannerMessage"
            examples:
              CreateBannerExamplesCustomBanner:
                $ref: "#/components/examples/CreateBannerExamplesCustomBanner"
    get:
      operationId: getBannerMessage
      tags:
        - banners
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Banners
      description: Get a list of all Banner objects.
      responses:
        "200":
          description: List of BannerMessage objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBannerMessage"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/banners/{id}:
    delete:
      operationId: deleteBannerMessageById
      tags:
        - banners
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Banner
      description: Delete the specified Banner.
      responses:
        "200":
          description: The deleted BannerMessage object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBannerMessage"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Banner to delete.
    get:
      operationId: getBannerMessageById
      tags:
        - banners
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Banner
      description: Get the specified Banner.
      responses:
        "200":
          description: List of BannerMessage objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBannerMessage"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Banner to get.
    patch:
      operationId: updateBannerMessageById
      tags:
        - banners
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Banner
      description: Update the specified Banner.<br/><br/>Provide a complete
        representation of the Banner that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Banner.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Banner might not
        function as expected.
      responses:
        "200":
          description: The updated BannerMessage object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBannerMessage"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: BannerMessage object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/BannerMessage"
            examples:
              UpdateBannerExamplesUpdateBannerMessage:
                $ref: "#/components/examples/UpdateBannerExamplesUpdateBannerMessage"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Banner to update.
  /system/certificates:
    post:
      operationId: createCertificate
      tags:
        - certificates
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Certificate
      description: Create a new Certificate.
      responses:
        "200":
          description: The created Certificate object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCertificate"
        "400":
          description: Bad Request — invalid PEM format or validation error
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "409":
          description: Conflict — Certificate with the same <code>id</code> already exists
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: Certificate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Certificate"
            examples:
              CreateCertificateExamplesSelfSignedCert:
                $ref: "#/components/examples/CreateCertificateExamplesSelfSignedCert"
    get:
      operationId: getCertificate
      tags:
        - certificates
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Certificates
      description: Get a list of all Certificates.
      responses:
        "200":
          description: List of Certificate objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCertificate"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/certificates/{id}:
    delete:
      operationId: deleteCertificateById
      tags:
        - certificates
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Certificate
      description: Delete the specified Certificate.
      responses:
        "200":
          description: The deleted Certificate object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCertificate"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "404":
          description: Certificate not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Certificate to delete.
    get:
      operationId: getCertificateById
      tags:
        - certificates
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Certificate
      description: Get the specified Certificate.
      responses:
        "200":
          description: List of Certificate objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCertificate"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "404":
          description: Certificate not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Certificate to get.
    patch:
      operationId: updateCertificateById
      tags:
        - certificates
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Certificate
      description: Update the specified Certificate.<br/><br/>Provide a complete
        representation of the Certificate that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Certificate.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Certificate
        might not function as expected.
      responses:
        "200":
          description: The updated Certificate object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCertificate"
        "400":
          description: Bad Request — invalid PEM format or validation error
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "404":
          description: Certificate not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: Certificate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Certificate"
            examples:
              UpdateCertificateExamplesUpdateCert:
                $ref: "#/components/examples/UpdateCertificateExamplesUpdateCert"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Certificate to update.
  /settings/features/{id}:
    get:
      operationId: getFeaturesEntryById
      tags:
        - features
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get a feature
      description: Get feature by id (i.e. 'type-name`).
      responses:
        "200":
          description: List of FeaturesEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedFeaturesEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Feature id
  /settings/features:
    get:
      operationId: getFeaturesEntry
      tags:
        - features
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List all features
      description: List all features.
      responses:
        "200":
          description: List of FeaturesEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedFeaturesEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/secret-folders/{folderId}/secrets:
    post:
      operationId: createGlobalSecretByFolderId
      tags:
        - secrets
      x-speakeasy-group: secrets.folders.secrets
      x-speakeasy-name-override: create
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Create a global secret
      description: Create a new global secret in the specified secret folder.
      responses:
        "200":
          description: The created GlobalSecret object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalSecret"
        "400":
          description: Bad Request — invalid request body or validation error
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: secret folder or secret store not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: GlobalSecretCreate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GlobalSecretCreate"
            examples:
              CreateGlobalSecretExamplesCriblBackedCredentialsSecret:
                $ref: "#/components/examples/CreateGlobalSecretExamplesCriblBackedCredentialsSe\
                  cret"
      parameters:
        - name: folderId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret folder.
    get:
      operationId: getGlobalSecretByFolderId
      tags:
        - secrets
      x-speakeasy-group: secrets.folders.secrets
      x-speakeasy-name-override: list
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List all global secrets in a secret folder
      description: Get a list of all global secrets in the specified secret folder.
      responses:
        "200":
          description: a list of global secret objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalSecret"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: folderId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret folder.
        - name: refs
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include runtime reference status for each
            global secret.
  /system/secret-folders/{folderId}/secrets/{id}:
    delete:
      operationId: deleteGlobalSecretByFolderIdAndId
      tags:
        - secrets
      x-speakeasy-group: secrets.folders.secrets
      x-speakeasy-name-override: delete
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Delete a global secret
      description: Delete the specified global secret from the specified secret folder.
      responses:
        "200":
          description: The deleted GlobalSecret object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalSecret"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Global secret not found
        "409":
          description: Conflict — global secret is referenced by active configurations
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: folderId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret folder.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the global secret to delete.
    get:
      operationId: getGlobalSecretByFolderIdAndId
      tags:
        - secrets
      x-speakeasy-group: secrets.folders.secrets
      x-speakeasy-name-override: get
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get a global secret
      description: Get the specified global secret from the specified secret folder.
      responses:
        "200":
          description: List of GlobalSecret objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalSecret"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: global secret not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: folderId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret folder.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the global secret to get.
    patch:
      operationId: updateGlobalSecretByFolderIdAndId
      tags:
        - secrets
      x-speakeasy-group: secrets.folders.secrets
      x-speakeasy-name-override: update
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Update a global secret
      description: Update the specified global secret in the specified secret
        folder.<br/><br/>Provide a complete representation of the global secret
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the global secret.<br/><br/>Confirm that the configuration in your
        request body is correct before sending the request. If the configuration
        is incorrect, the updated global secret might not function as expected.
      responses:
        "200":
          description: The updated GlobalSecret object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalSecret"
        "400":
          description: Bad Request — invalid request body or validation error
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: global secret, secret folder, or secret store not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: GlobalSecretUpdate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GlobalSecretUpdate"
            examples:
              UpdateGlobalSecretExamplesCriblBackedCredentialsSecret:
                $ref: "#/components/examples/UpdateGlobalSecretExamplesCriblBackedCredentialsSe\
                  cret"
      parameters:
        - name: folderId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret folder.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the global secret to update.
  /system/secret-folders/{folderId}/secrets/{id}/refs:
    get:
      operationId: getGlobalSecretRefsByFolderIdAndId
      tags:
        - secrets
      x-speakeasy-group: secrets.folders.secrets
      x-speakeasy-name-override: listReferences
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List references to a global secret
      description: Get a list of the entities that reference the specified global
        secret in the specified secret folder.
      responses:
        "200":
          description: List of GlobalSecretReference objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGlobalSecretReference"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: folderId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret folder.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret.
  /master/groups:
    post:
      operationId: createGroups
      tags:
        - groups
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a Fleet, Worker Group, or Outpost Group
      description: Create a Fleet, Worker Group, or Outpost Group. Deprecated.
        <br/><br/>Use <code>POST /products/{product}/groups</code> instead.
      deprecated: true
      responses:
        "200":
          description: The created ConfigGroup object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: GroupCreateRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GroupCreateRequest"
            examples:
              CreateGroupExamplesCloudWg:
                $ref: "#/components/examples/CreateGroupExamplesCloudWg"
              CreateGroupExamplesOnPremWg:
                $ref: "#/components/examples/CreateGroupExamplesOnPremWg"
              CreateGroupExamplesCloneWg:
                $ref: "#/components/examples/CreateGroupExamplesCloneWg"
              CreateGroupExamplesEdgeFleet:
                $ref: "#/components/examples/CreateGroupExamplesEdgeFleet"
    get:
      operationId: getGroups
      tags:
        - groups
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a list of ConfigGroup objects
      description: Get a list of ConfigGroup objects. Deprecated. <br/><br/>Use
        <code>GET /products/{product}/groups</code> instead.
      deprecated: true
      responses:
        "200":
          description: List of ConfigGroup objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: fields
          in: query
          required: false
          schema:
            type: string
          description: "fields to add to results: git.commit, git.localChanges, git.log"
        - name: product
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/ProductsAll"
          description: filter to specific product
  /master/groups/{id}:
    delete:
      operationId: deleteGroupsById
      tags:
        - groups
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Worker Group, Outpost Group, or Edge Fleet
      description: Delete the specified Worker Group, Outpost Group, or Edge Fleet.
        Deprecated. Use <code>DELETE /products/{product}/groups/{id}</code>
        instead.
      deprecated: true
      responses:
        "200":
          description: The deleted ConfigGroup object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to delete.
    get:
      operationId: getGroupsById
      tags:
        - groups
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Worker Group, Outpost Group, or Edge Fleet
      description: Get the specified Worker Group, Outpost Group, or Edge Fleet.
        Deprecated. Use <code>GET /products/{product}/groups/{id}</code>
        instead.
      deprecated: true
      responses:
        "200":
          description: List of ConfigGroup objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to get.
        - name: fields
          in: query
          required: false
          schema:
            type: string
          description: Comma-separated list of additional properties to include in the
            response. Available values are <code>git.commit</code>,
            <code>git.localChanges</code>, and <code>git.log</code>.
    patch:
      operationId: updateGroupsById
      tags:
        - groups
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Worker Group, Outpost Group, or Edge Fleet
      description: Update the specified Worker Group, Outpost Group, or Edge Fleet.
        Deprecated. Use <code>PATCH /products/{product}/groups/{id}</code>
        instead.<br/><br/>Provide a complete representation of the Group or
        Fleet that you want to update in the request body. This endpoint does
        not support partial updates. Cribl removes any omitted fields when
        updating the Group or Fleet.<br/><br/>Confirm that the configuration in
        your request body is correct before sending the request. If the
        configuration is incorrect, the updated Group or Fleet might not
        function as expected.
      deprecated: true
      responses:
        "200":
          description: The updated ConfigGroup object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ConfigGroup object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ConfigGroup"
            examples:
              UpdateGroupExamplesScaleCloudWorkerGroup:
                $ref: "#/components/examples/UpdateGroupExamplesScaleCloudWorkerGroup"
              UpdateGroupExamplesUpdateOnPremWorkerGroup:
                $ref: "#/components/examples/UpdateGroupExamplesUpdateOnPremWorkerGroup"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to update.
  /master/groups/{id}/acl:
    get:
      operationId: getGroupsAclById
      tags:
        - groups
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the Access Control List for a Worker Group, Outpost Group, or Edge
        Fleet
      description: Get the Access Control List (ACL) for the specified Worker Group,
        Outpost Group, or Edge Fleet. Deprecated. Use <code>GET
        /products/{product}/groups/{id}/acl</code> instead.
      deprecated: true
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to get the ACL for.
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/RbacResource"
          description: Filter for limiting the response to ACL entries for the specified
            RBAC resource type.
  /master/groups/{id}/acl/apply:
    post:
      operationId: createConfigGroupAclApplyById
      deprecated: true
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclApplyGroupExamplesGrantAccess:
                $ref: "#/components/examples/AclApplyGroupExamplesGrantAccess"
              AclApplyGroupExamplesRevokeAccess:
                $ref: "#/components/examples/AclApplyGroupExamplesRevokeAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: both
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Create
      description: Add/remove accesses to ConfigGroup for users.
      summary: Modify ConfigGroup ACL
      tags:
        - groups
  /master/groups/{id}/acl/teams:
    get:
      operationId: getConfigGroupAclTeamsById
      deprecated: true
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: both
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Get
      description: List accesses to ConfigGroup granted to Teams.
      summary: Get ConfigGroup Teams
      tags:
        - groups
  /master/groups/{id}/acl/teams/apply:
    post:
      operationId: createConfigGroupAclTeamsApplyById
      deprecated: true
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclTeamsApplyGroupExamplesGrantTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyGroupExamplesGrantTeamAccess"
              AclTeamsApplyGroupExamplesRevokeTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyGroupExamplesRevokeTeamAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: both
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Create
      description: Add/remove accesses to ConfigGroup for Teams.
      summary: Modify ConfigGroup Teams ACL
      tags:
        - groups
  /master/groups/{id}/configVersion:
    get:
      operationId: getGroupsConfigVersionById
      tags:
        - groups
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the configuration version for a Worker Group, Outpost Group, or
        Edge Fleet
      description: Get the configuration version for the specified Worker Group,
        Outpost Group, or Edge Fleet. Deprecated. Use <code>GET
        /products/{product}/groups/{id}/configVersion</code> instead.
      deprecated: true
      responses:
        "200":
          description: List of string objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to get the configuration version for.
  /master/groups/{id}/deploy:
    patch:
      operationId: updateGroupsDeployById
      tags:
        - groups
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Deploy commits to a Worker Group, Outpost Group, or Edge Fleet
      description: Deploy commits to the specified Worker Group or Edge Fleet.
        Deprecated. Use <code>PATCH
        /products/{product}/groups/{id}/deploy</code> instead.
      deprecated: true
      responses:
        "200":
          description: The updated ConfigGroup object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DeployRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DeployRequest"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the target Worker Group, Outpost Group, or
            Edge Fleet for commit deployment.
  /products/{product}/groups:
    get:
      operationId: listConfigGroupByProduct
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - groups
      summary: List all Worker Groups, Outpost Groups, or Edge Fleets for the
        specified Cribl product
      description: Get a list of all Worker Groups, Outpost Groups, or Edge Fleets for
        the specified Cribl product.
      responses:
        "200":
          description: List of ConfigGroup objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: groups
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to get the Worker Groups, Outpost Groups,
            or Edge Fleets for.
        - name: fields
          in: query
          required: false
          schema:
            type: string
          description: Comma-separated list of additional properties to include in the
            response. Available values are <code>git.commit</code>,
            <code>git.localChanges</code>, and <code>git.log</code>.
    post:
      operationId: createConfigGroupByProduct
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - groups
      summary: Create a Worker Group, Outpost Group, or Edge Fleet for the specified
        Cribl product
      description: Create a new Worker Group, Outpost Group, or Edge Fleet for the
        specified Cribl product.
      requestBody:
        description: GroupCreateRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GroupCreateRequest"
            examples:
              CreateGroupExamplesCloudWg:
                $ref: "#/components/examples/CreateGroupExamplesCloudWg"
              CreateGroupExamplesOnPremWg:
                $ref: "#/components/examples/CreateGroupExamplesOnPremWg"
              CreateGroupExamplesCloneWg:
                $ref: "#/components/examples/CreateGroupExamplesCloneWg"
              CreateGroupExamplesEdgeFleet:
                $ref: "#/components/examples/CreateGroupExamplesEdgeFleet"
      responses:
        "200":
          description: The created ConfigGroup object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: groups
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to add the Worker Group, Outpost Group,
            or Edge Fleet to.
  /products/{product}/groups/{id}:
    get:
      operationId: getConfigGroupByProductAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - groups
      summary: Get a Worker Group, Outpost Group, or Edge Fleet
      description: Get the specified Worker Group, Outpost Group, or Edge Fleet.
      parameters:
        - name: product
          in: path
          required: true
          schema:
            type: string
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to get the Worker Groups, Outpost Groups,
            or Edge Fleets for.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to get.
        - name: fields
          in: query
          required: false
          schema:
            type: string
          description: Comma-separated list of additional properties to include in the
            response. Available values are <code>git.commit</code>,
            <code>git.localChanges</code>, and <code>git.log</code>.
      responses:
        "200":
          description: List of ConfigGroup objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: groups
    patch:
      operationId: updateConfigGroupByProductAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - groups
      summary: Update a Worker Group, Outpost Group, or Edge Fleet
      description: "Update the specified Worker Group, Outpost Group, or Edge
        Fleet.<br/><br/>Provide a complete representation of the Group or Fleet
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the Group or Fleet.<br/><br/>Confirm that the configuration in your
        request body is correct before sending the request. If the configuration
        is incorrect, the updated Group or Fleet might not function as
        expected.<br/><br/>**Warning**: Do not change the values for the
        following parameters in the body of PATCH requests. The request body
        must include the values as they appear in the <code>GET
        /products/{product}/groups/{id}</code> response.<br/> -
        <code>configVersion</code><br/> - <code>deployingWorkerCount</code><br/>
        - <code>incompatibleWorkerCount</code><br/> -
        <code>workerCount</code><br/> - <code>lookupDeployments</code>."
      parameters:
        - name: product
          in: path
          required: true
          schema:
            type: string
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to get the Worker Groups, Outpost Groups,
            or Edge Fleets for.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to update.
      requestBody:
        description: ConfigGroup object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ConfigGroup"
            examples:
              UpdateGroupExamplesScaleCloudWorkerGroup:
                $ref: "#/components/examples/UpdateGroupExamplesScaleCloudWorkerGroup"
              UpdateGroupExamplesUpdateOnPremWorkerGroup:
                $ref: "#/components/examples/UpdateGroupExamplesUpdateOnPremWorkerGroup"
      responses:
        "200":
          description: The updated ConfigGroup object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: groups
    delete:
      operationId: deleteConfigGroupByProductAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - groups
      summary: Delete a Worker Group, Outpost Group, or Edge Fleet
      description: Delete the specified Worker Group, Outpost Group, or Edge Fleet.
      parameters:
        - name: product
          in: path
          required: true
          schema:
            type: string
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to get the Worker Groups, Outpost Groups,
            or Edge Fleets for.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to delete.
      responses:
        "200":
          description: The deleted ConfigGroup object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: groups
  /products/{product}/groups/{id}/configVersion:
    get:
      operationId: getConfigGroupConfigVersionByProductAndId
      tags:
        - groups
      x-speakeasy-group: groups.configs.versions
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the configuration version for a Worker Group, Outpost Group, or
        Edge Fleet
      description: Get the configuration version for the specified Worker Group,
        Outpost Group, or Edge Fleet.
      responses:
        "200":
          description: List of string objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to get the Worker Groups, Outpost Groups,
            or Edge Fleets for.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to get the configuration version for.
  /products/{product}/groups/{id}/deploy:
    patch:
      operationId: updateConfigGroupDeployByProductAndId
      tags:
        - groups
      x-speakeasy-group: groups
      x-speakeasy-name-override: deploy
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Deploy commits to a Worker Group, Outpost Group, or Edge Fleet
      description: Deploy commits to the specified Worker Group, Outpost Group, or
        Edge Fleet.
      responses:
        "200":
          description: The updated ConfigGroup object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DeployRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DeployRequest"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to deploy commits to the Worker Groups,
            Outpost Groups, or Edge Fleets for.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the target Worker Group, Outpost Group, or
            Edge Fleet for commit deployment.
  /products/{product}/groups/{id}/acl/teams:
    get:
      operationId: getConfigGroupAclTeamsByProductAndId
      tags:
        - teams
      x-speakeasy-group: groups.acl.teams
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the Access Control List for teams with permissions on a Worker
        Group, Outpost Group, or Edge Fleet for the specified Cribl product
      description: Get the Access Control List (ACL) for teams that have permissions
        on a Worker Group, Outpost Group, or Edge Fleet for the specified Cribl
        product.
      responses:
        "200":
          description: List of TeamAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedTeamAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product that contains the Worker Group, Outpost
            Group, or Edge Fleet.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to get the team ACL for.
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/RbacResource"
          description: Filter for limiting the response to ACL entries for the specified
            RBAC resource type.
  /products/{product}/groups/{id}/acl:
    get:
      operationId: getConfigGroupAclByProductAndId
      tags:
        - groups
      x-speakeasy-group: groups.acl
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the Access Control List for a Worker Group, Outpost Group, or Edge
        Fleet
      description: Get the Access Control List (ACL) for the specified Worker Group,
        Outpost Group, or Edge Fleet.
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to get the Worker Groups or Edge Fleets
            for.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Outpost Group, or Edge
            Fleet to get the ACL for.
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/RbacResource"
          description: Filter for limiting the response to ACL entries for the specified
            RBAC resource type.
  /system/keys:
    post:
      operationId: createKeyMetadataEntity
      tags:
        - keys
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create an Encryption Key
      description: Create a new Encryption Key.
      responses:
        "200":
          description: The created KeyMetadataEntity object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedKeyMetadataEntity"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: KeyMetadataEntity object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/KeyMetadataEntity"
            examples:
              CreateKeyExamplesAESKey:
                $ref: "#/components/examples/CreateKeyExamplesAESKey"
    get:
      operationId: getKeyMetadataEntity
      tags:
        - keys
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Encryption Keys
      description: Get a list of all Encryption Key objects.
      responses:
        "200":
          description: List of KeyMetadataEntity objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedKeyMetadataEntity"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/keys/{id}:
    delete:
      operationId: deleteKeyMetadataEntityById
      tags:
        - keys
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete an Encryption Key
      description: Delete the specified Encryption Key.
      responses:
        "200":
          description: The deleted KeyMetadataEntity object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedKeyMetadataEntity"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Encryption Key to delete.
    get:
      operationId: getKeyMetadataEntityById
      tags:
        - keys
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get an Encryption Key
      description: Get the specified Encryption Key.
      responses:
        "200":
          description: List of KeyMetadataEntity objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedKeyMetadataEntity"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Encryption Key to get.
    patch:
      operationId: updateKeyMetadataEntityById
      tags:
        - keys
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update an Encryption Key
      description: Update the specified Encryption Key.<br/><br/>Provide a complete
        representation of the Encryption Key that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Encryption
        Key.<br/><br/>Confirm that the configuration in your request body is
        correct before sending the request. If the configuration is incorrect,
        the updated Encryption Key might not function as expected.
      responses:
        "200":
          description: The updated KeyMetadataEntity object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedKeyMetadataEntity"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: KeyMetadataEntity object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/KeyMetadataEntity"
            examples:
              UpdateKeyExamplesUpdateKey:
                $ref: "#/components/examples/UpdateKeyExamplesUpdateKey"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Encryption Key to update.
  /admin/products/{product}/mappings/activate:
    post:
      operationId: createAdminProductsMappingsActivateByProduct
      tags:
        - mappings
      x-speakeasy-group: groups.mappings
      x-speakeasy-name-override: activate
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Set a Mapping Ruleset as the active configuration for a Cribl product
      description: Set the Mapping Ruleset specified in the request body as the
        currently active configuration for the specified Cribl product.
      responses:
        "200":
          description: The <code>id</code> of the activated Mapping Ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRulesetId"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: RulesetId object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RulesetId"
            examples:
              MappingRulesetActivateExamplesActivate:
                $ref: "#/components/examples/MappingRulesetActivateExamplesActivate"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsBase"
          description: The name of the Cribl product to activate the Mapping Ruleset for.
  /admin/products/{product}/mappings:
    post:
      operationId: createAdminProductsMappingsByProduct
      tags:
        - mappings
      x-speakeasy-group: groups.mappings
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a new Mapping Ruleset for a Cribl product
      description: "Create a new Mapping Ruleset for the specified Cribl
        product.<br><br>Note: Not supported for Cribl Stream Workers on
        Cribl.Cloud."
      responses:
        "200":
          description: A list that contains the new Mapping Ruleset objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMappingRuleset"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: MappingRuleset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MappingRuleset"
            examples:
              MappingRulesetCreateExamplesOSBasedMapping:
                $ref: "#/components/examples/MappingRulesetCreateExamplesOSBasedMapping"
              MappingRulesetCreateExamplesTagBasedMapping:
                $ref: "#/components/examples/MappingRulesetCreateExamplesTagBasedMapping"
              MappingRulesetCreateExamplesOutpostBasedMapping:
                $ref: "#/components/examples/MappingRulesetCreateExamplesOutpostBasedMapping"
              MappingRulesetCreateExamplesComplexMapping:
                $ref: "#/components/examples/MappingRulesetCreateExamplesComplexMapping"
              MappingRulesetCreateExamplesAWSEC2InstanceMapping:
                $ref: "#/components/examples/MappingRulesetCreateExamplesAWSEC2InstanceMapping"
              MappingRulesetCreateExamplesContainerBasedMapping:
                $ref: "#/components/examples/MappingRulesetCreateExamplesContainerBasedMapping"
              MappingRulesetCreateExamplesDefaultRuleset:
                $ref: "#/components/examples/MappingRulesetCreateExamplesDefaultRuleset"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsBase"
          description: The name of the Cribl product to create the Mapping Ruleset for.
    get:
      operationId: getAdminProductsMappingsByProduct
      tags:
        - mappings
      x-speakeasy-group: groups.mappings
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Mapping Rulesets for a Cribl product
      description: Get a list of all Mapping Rulesets for the specified Cribl product.
      responses:
        "200":
          description: List of Mapping Rulesets
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMappingRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsBase"
          description: The name of the Cribl product to list the Mapping Rulesets for.
  /admin/products/{product}/mappings/{id}:
    delete:
      operationId: deleteAdminProductsMappingsByProductAndId
      tags:
        - mappings
      x-speakeasy-group: groups.mappings
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a Mapping Ruleset
      description: "Delete the specified Mapping Ruleset.<br><br>Note: Not supported
        for Cribl Stream Workers on Cribl.Cloud."
      responses:
        "200":
          description: A list that contains the deleted Mapping Ruleset objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMappingRuleset"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsBase"
          description: The name of the Cribl product to delete the Mapping Ruleset for.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Mapping Ruleset to delete.
    get:
      operationId: getAdminProductsMappingsByProductAndId
      tags:
        - mappings
      x-speakeasy-group: groups.mappings
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Mapping Ruleset
      description: Get the specified Mapping Ruleset.
      responses:
        "200":
          description: Mapping Ruleset details
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMappingRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsBase"
          description: The name of the Cribl product that contains the Worker Group or
            Edge Fleet.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Mapping Ruleset to get.
    patch:
      operationId: updateAdminProductsMappingsByProductAndId
      tags:
        - mappings
      x-speakeasy-group: groups.mappings
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a Mapping Ruleset
      description: Update the specified Mapping Ruleset.<br/><br/>Provide a complete
        representation of the Mapping Ruleset that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Mapping
        Ruleset.<br/><br/>Confirm that the configuration in your request body is
        correct before sending the request. If the configuration is incorrect,
        the updated Mapping Ruleset might not function as expected.
      responses:
        "200":
          description: A list that contains the updated Mapping Ruleset objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMappingRuleset"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: MappingRuleset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MappingRuleset"
            examples:
              MappingRulesetUpdateExamplesUpdateComplexRule:
                $ref: "#/components/examples/MappingRulesetUpdateExamplesUpdateComplexRule"
              MappingRulesetUpdateExamplesEnableDisabledRule:
                $ref: "#/components/examples/MappingRulesetUpdateExamplesEnableDisabledRule"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsBase"
          description: The name of the Cribl product that contains the Mapping Ruleset.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Mapping Ruleset to update.
  /system/messages:
    post:
      operationId: createBulletinMessage
      tags:
        - messages
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a message
      description: Create a new Message to display in the Cribl UI for system
        notifications, alerts, and informational bulletins.
      responses:
        "200":
          description: The created BulletinMessage object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBulletinMessage"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: BulletinMessage object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/BulletinMessage"
            examples:
              CreateMessageExamplesInfoMessage:
                $ref: "#/components/examples/CreateMessageExamplesInfoMessage"
              CreateMessageExamplesWarningMessage:
                $ref: "#/components/examples/CreateMessageExamplesWarningMessage"
    get:
      operationId: getBulletinMessage
      tags:
        - messages
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all messages
      description: Get a list of messages.
      responses:
        "200":
          description: List of BulletinMessage objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBulletinMessage"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/messages/{id}:
    delete:
      operationId: deleteBulletinMessageById
      tags:
        - messages
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Delete a message
      description: Delete a bulletin message by ID.
      responses:
        "200":
          description: The deleted BulletinMessage object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBulletinMessage"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Bulletin message ID
    get:
      operationId: getBulletinMessageById
      tags:
        - messages
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get a message
      description: Get a message by ID.
      responses:
        "200":
          description: List of BulletinMessage objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBulletinMessage"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: message ID
  /notification-targets:
    get:
      operationId: listNotificationTarget
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - notification-targets
      summary: Get a list of NotificationTarget objects
      description: Get a list of NotificationTarget objects.
      responses:
        "200":
          description: List of NotificationTarget objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotificationTarget"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createNotificationTarget
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - notification-targets
      summary: Create NotificationTarget
      description: Create NotificationTarget.
      requestBody:
        description: New NotificationTarget object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/NotificationTarget"
      responses:
        "200":
          description: The created NotificationTarget object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotificationTarget"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /notification-targets/{id}:
    get:
      operationId: getNotificationTargetById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - notification-targets
      summary: Get NotificationTarget by ID
      description: Get NotificationTarget by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of NotificationTarget objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotificationTarget"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateNotificationTargetById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - notification-targets
      summary: Update NotificationTarget
      description: Update NotificationTarget.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to PATCH
      requestBody:
        description: NotificationTarget object to be updated.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/NotificationTarget"
      responses:
        "200":
          description: The updated NotificationTarget object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotificationTarget"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteNotificationTargetById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - notification-targets
      summary: Delete NotificationTarget
      description: Delete NotificationTarget.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted NotificationTarget object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotificationTarget"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /notifications:
    get:
      operationId: listNotification
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - notifications
      summary: List all Notifications
      description: Get a list of all Notifications.
      responses:
        "200":
          description: List of Notification objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: notifications
      parameters:
        - name: groupId
          in: query
          required: false
          schema:
            type: string
          description: The <code>id</code> of the Worker Group or Edge Fleet to filter
            Notifications by.
        - name: includePacks
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include Pack Notifications in the
            response. Cannot be combined with a Pack context.
    post:
      operationId: createNotification
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - notifications
      summary: Create a Notification
      description: Create a new Notification.
      requestBody:
        description: Notification object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Notification"
            examples:
              CreateNotificationExamplesHighVolumeSource:
                $ref: "#/components/examples/CreateNotificationExamplesHighVolumeSource"
              CreateNotificationExamplesUnhealthyDestination:
                $ref: "#/components/examples/CreateNotificationExamplesUnhealthyDestination"
      responses:
        "200":
          description: The created Notification object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: notifications
  /notifications/{id}:
    get:
      operationId: getNotificationById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - notifications
      summary: Get Notification by ID
      description: Get Notification by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Notification objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateNotificationById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - notifications
      summary: Update a Notification
      description: Update the specified Notification.<br/><br/>Provide a complete
        representation of the Notification that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the
        Notification.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated Notification might not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notification to update.
      requestBody:
        description: Notification object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Notification"
            examples:
              UpdateNotificationExamplesUpdateHighVolumeSource:
                $ref: "#/components/examples/UpdateNotificationExamplesUpdateHighVolumeSource"
      responses:
        "200":
          description: The updated Notification object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: notifications
    delete:
      operationId: deleteNotificationById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - notifications
      summary: Delete a Notification
      description: Delete the specified Notification.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notification to delete.
      responses:
        "200":
          description: The deleted Notification object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: notifications
  /p/{pack}/notifications:
    get:
      operationId: getNotificationByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - notifications
      summary: List all Notifications within a Pack
      description: Get a list of all Notifications within the specified Pack.
      responses:
        "200":
          description: List of Notification objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.notifications
      parameters:
        - name: groupId
          in: query
          required: false
          schema:
            type: string
          description: The <code>id</code> of the Worker Group or Edge Fleet to filter
            Notifications by.
        - name: includePacks
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include Pack Notifications in the
            response. Cannot be combined with a Pack context.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    post:
      operationId: createNotificationByPack
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - notifications
      summary: Create a Notification within a Pack
      description: Create a new Notification within the specified Pack.
      requestBody:
        description: Notification object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Notification"
            examples:
              CreateNotificationExamplesHighVolumeSource:
                $ref: "#/components/examples/CreateNotificationExamplesHighVolumeSource"
              CreateNotificationExamplesUnhealthyDestination:
                $ref: "#/components/examples/CreateNotificationExamplesUnhealthyDestination"
      responses:
        "200":
          description: The created Notification object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.notifications
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /p/{pack}/notifications/{id}:
    get:
      operationId: getNotificationByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - notifications
      summary: Get Notification by ID within a Pack
      description: Get Notification by ID within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: List of Notification objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.notifications
    patch:
      operationId: updateNotificationByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - notifications
      summary: Update a Notification within a Pack
      description: Update the specified Notification.<br/><br/>Provide a complete
        representation of the Notification that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the
        Notification.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated Notification might not function as expected
        within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notification to update.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      requestBody:
        description: Notification object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Notification"
            examples:
              UpdateNotificationExamplesUpdateHighVolumeSource:
                $ref: "#/components/examples/UpdateNotificationExamplesUpdateHighVolumeSource"
      responses:
        "200":
          description: The updated Notification object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.notifications
    delete:
      operationId: deleteNotificationByPackAndId
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - notifications
      summary: Delete a Notification within a Pack
      description: Delete the specified Notification within the specified Pack.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notification to delete.
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      responses:
        "200":
          description: The deleted Notification object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotification"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.notifications
  /system/policies:
    post:
      operationId: createPolicyRule
      tags:
        - policies
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Create a Policy
      description: Create a new policy.
      responses:
        "200":
          description: The created PolicyRule object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPolicyRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: PolicyRule object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PolicyRule"
    get:
      operationId: getPolicyRule
      tags:
        - policies
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Policies
      description: Get a list of policies.
      responses:
        "200":
          description: List of PolicyRule objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPolicyRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/policies/{id}:
    delete:
      operationId: deletePolicyRuleById
      tags:
        - policies
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Delete a Policy
      description: Delete a policy by ID.
      responses:
        "200":
          description: The deleted PolicyRule object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPolicyRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Policy ID
    get:
      operationId: getPolicyRuleById
      tags:
        - policies
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Policy
      description: Get a policy by ID.
      responses:
        "200":
          description: List of PolicyRule objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPolicyRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Policy ID
    patch:
      operationId: updatePolicyRuleById
      tags:
        - policies
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Update a Policy
      description: Update the specified Policy.<br/><br/>Provide a complete
        representation of the Policy that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Policy.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Policy might not
        function as expected.
      responses:
        "200":
          description: The updated PolicyRule object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPolicyRule"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: PolicyRule object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PolicyRule"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Policy ID
  /system/provisioning-tokens:
    post:
      operationId: createSystemProvisioningTokens
      tags:
        - provisioning-tokens
      x-speakeasy-group: provisioningTokens
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a provisioning token
      description: Create a new provisioning token. The response includes the one-time
        plaintext JSON Web Token (JWT) value. The response is the only time the
        plaintext <code>token</code> value is available. It is never stored on
        the Leader. Copy the <code>token</code> value immediately before closing
        the response.
      responses:
        "200":
          description: The created ProvisioningTokenWithSecret object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProvisioningTokenWithSecret"
        "400":
          description: Validation error
        "401":
          description: Unauthorized
        "403":
          description: Forbidden
        "409":
          description: Token id already exists
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ProvisioningTokenCreate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProvisioningTokenCreate"
            examples:
              CreateProvisioningTokenExamplesCreateStandardToken:
                $ref: "#/components/examples/CreateProvisioningTokenExamplesCreateStandardToken"
    get:
      operationId: getSystemProvisioningTokens
      tags:
        - provisioning-tokens
      x-speakeasy-group: provisioningTokens
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all provisioning tokens
      description: Get a list of all provisioning tokens with their configuration and
        status. The response does not include the plaintext values of any
        provisioning tokens.
      responses:
        "200":
          description: List of ProvisioningToken objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProvisioningToken"
        "401":
          description: Unauthorized
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/provisioning-tokens/{id}:
    delete:
      operationId: deleteSystemProvisioningTokensById
      tags:
        - provisioning-tokens
      x-speakeasy-group: provisioningTokens
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a provisioning token
      description: Permanently delete the specified provisioning token record. The
        token must be in revoked status before it can be deleted. This operation
        cannot be undone. Admin role required.
      responses:
        "200":
          description: Deleted provisioning token
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProvisioningToken"
        "401":
          description: Unauthorized
        "403":
          description: Forbidden — admin role required
        "404":
          description: Token not found
        "409":
          description: Token is not revoked
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the provisioning token to delete.
    get:
      operationId: getSystemProvisioningTokensById
      tags:
        - provisioning-tokens
      x-speakeasy-group: provisioningTokens
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a provisioning token
      description: Get the specified provisioning token. The response does not include
        the plaintext value of the provisioning token.
      responses:
        "200":
          description: List of ProvisioningToken objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProvisioningToken"
        "401":
          description: Unauthorized
        "403":
          description: Forbidden
        "404":
          description: Token not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the provisioning token to get.
    patch:
      operationId: updateSystemProvisioningTokensById
      tags:
        - provisioning-tokens
      x-speakeasy-group: provisioningTokens
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update a provisioning token
      description: Update the specified provisioning token. All fields are optional.
        Omitted fields default to their zero value (<code>null</code> for
        nullable fields, empty string for <code>description</code>). To preserve
        a field's current value, include it in the request
        body.<br/><br/>Revoked tokens cannot be updated.<br/><br/>The mutable
        parameters are:<br/> - <code>description</code> (optional, defaults to
        empty string if omitted)<br/> - <code>distMode</code> (optional,
        defaults to <code>null</code> if omitted)<br/> - <code>useLimit</code>
        (optional, defaults to <code>null</code> if omitted)<br/> -
        <code>expiresAt</code> (optional, defaults to <code>null</code> if
        omitted).
      responses:
        "200":
          description: The updated ProvisioningToken object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProvisioningToken"
        "400":
          description: Validation error
        "401":
          description: Unauthorized
        "403":
          description: Forbidden
        "404":
          description: Token not found
        "409":
          description: Token is revoked
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ProvisioningTokenUpdate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProvisioningTokenUpdate"
            examples:
              UpdateProvisioningTokenExamplesUpdateTokenDescription:
                $ref: "#/components/examples/UpdateProvisioningTokenExamplesUpdateTokenDescript\
                  ion"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the provisioning token to update.
  /system/provisioning-tokens/{id}/reveal:
    post:
      operationId: createSystemProvisioningTokensRevealById
      tags:
        - provisioning-tokens
      x-speakeasy-group: provisioningTokens
      x-speakeasy-name-override: reveal
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Reveal a legacy provisioning token
      description: Reveal the plaintext value of a legacy (migrated) provisioning
        token. Standard tokens cannot be revealed because their plaintext values
        are not stored on the Leader.
      responses:
        "200":
          description: The created ProvisioningTokenWithSecret object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProvisioningTokenWithSecret"
        "400":
          description: Token is a standard token (plaintext not stored)
        "401":
          description: Unauthorized
        "403":
          description: Forbidden — admin role required
        "404":
          description: Token not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the provisioning token to reveal.
  /system/provisioning-tokens/{id}/revoke:
    post:
      operationId: createSystemProvisioningTokensRevokeById
      tags:
        - provisioning-tokens
      x-speakeasy-group: provisioningTokens
      x-speakeasy-name-override: revoke
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Revoke a provisioning token
      description: Revoke the specified provisioning token. Sets
        <code>revokedAt</code> on the specified token. Revoking a provisioning
        token is permanent and cannot be undone.<br/><br/>Revoking a
        provisioning token does not disconnect currently connected Nodes. The
        connected Nodes continue on their existing session. Nodes that present
        the revoked provisioning token on reconnection will be rejected.
      responses:
        "200":
          description: The created ProvisioningToken object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProvisioningToken"
        "401":
          description: Unauthorized
        "403":
          description: Forbidden
        "404":
          description: Token not found
        "409":
          description: Token is already revoked
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ProvisioningTokenRevokeRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProvisioningTokenRevokeRequest"
            examples:
              RevokeProvisioningTokenExamplesRevokeWithReason:
                $ref: "#/components/examples/RevokeProvisioningTokenExamplesRevokeWithReason"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the provisioning token to revoke.
  /system/roles:
    get:
      operationId: listRole
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - roles
      summary: Get a list of Role objects
      description: Get a list of Role objects.
      responses:
        "200":
          description: List of Role objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRole"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createRole
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - roles
      summary: Create a Role
      description: Create a new Role.
      requestBody:
        description: Role object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Role"
            examples:
              CreateRoleExamplesCustomRole:
                $ref: "#/components/examples/CreateRoleExamplesCustomRole"
      responses:
        "200":
          description: The created Role object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRole"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/roles/{id}:
    get:
      operationId: getRoleById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - roles
      summary: Get Role by ID
      description: Get Role by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Role objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRole"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateRoleById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - roles
      summary: Update a Role
      description: Update the specified Role.<br/><br/>Provide a complete
        representation of the Role that you want to update in the request body.
        This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Role.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Role might not
        function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Role to update.
      requestBody:
        description: Role object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Role"
            examples:
              UpdateRoleExamplesUpdateRole:
                $ref: "#/components/examples/UpdateRoleExamplesUpdateRole"
      responses:
        "200":
          description: The updated Role object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRole"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteRoleById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - roles
      summary: Delete Role
      description: Delete Role.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted Role object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRole"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/scripts:
    get:
      operationId: listScriptLibEntry
      x-cribl-internal: false
      x-cribl-availability: onprem
      x-speakeasy-name-override: list
      tags:
        - scripts
      summary: Get a list of ScriptLibEntry objects (on-prem only)
      description: Get a list of ScriptLibEntry objects (on-prem only).
      responses:
        "200":
          description: List of ScriptLibEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedScriptLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createScriptLibEntry
      x-cribl-internal: false
      x-cribl-availability: onprem
      x-speakeasy-name-override: create
      tags:
        - scripts
      summary: Create a Script (on-prem only)
      description: Create a new Script (on-prem only).
      requestBody:
        description: ScriptLibEntry object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ScriptLibEntry"
            examples:
              CreateScriptExamplesShellScript:
                $ref: "#/components/examples/CreateScriptExamplesShellScript"
      responses:
        "200":
          description: The created ScriptLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedScriptLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/scripts/{id}:
    get:
      operationId: getScriptLibEntryById
      x-cribl-internal: false
      x-cribl-availability: onprem
      x-speakeasy-name-override: get
      tags:
        - scripts
      summary: Get ScriptLibEntry by ID (on-prem only)
      description: Get ScriptLibEntry by ID (on-prem only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of ScriptLibEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedScriptLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateScriptLibEntryById
      x-cribl-internal: false
      x-cribl-availability: onprem
      x-speakeasy-name-override: update
      tags:
        - scripts
      summary: Update a Script (on-prem only)
      description: Update the specified Script (on-prem only).<br/><br/>Provide a
        complete representation of the Script that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Script.<br/><br/>Confirm
        that the configuration in your request body is correct before sending
        the request. If the configuration is incorrect, the updated Script might
        not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Script to update.
      requestBody:
        description: ScriptLibEntry object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ScriptLibEntry"
            examples:
              UpdateScriptExamplesUpdateScript:
                $ref: "#/components/examples/UpdateScriptExamplesUpdateScript"
      responses:
        "200":
          description: The updated ScriptLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedScriptLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteScriptLibEntryById
      x-cribl-internal: false
      x-cribl-availability: onprem
      x-speakeasy-name-override: delete
      tags:
        - scripts
      summary: Delete ScriptLibEntry (on-prem only)
      description: Delete ScriptLibEntry (on-prem only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted ScriptLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedScriptLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/secret-folders:
    post:
      operationId: createSecretFolder
      tags:
        - secretFolders
      x-speakeasy-group: secrets.folders
      x-speakeasy-name-override: create
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Create a secret folder
      description: Create a new secret folder.
      responses:
        "200":
          description: The created SecretFolderWithRuntimeState object in a single-item
            list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretFolderWithRuntimeState"
        "400":
          description: Bad Request — invalid request body or unknown secret store
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SecretFolderCreate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SecretFolderCreate"
            examples:
              CreateSecretFolderExamplesCriblBackedFolder:
                $ref: "#/components/examples/CreateSecretFolderExamplesCriblBackedFolder"
    get:
      operationId: getSecretFolder
      tags:
        - secretFolders
      x-speakeasy-group: secrets.folders
      x-speakeasy-name-override: list
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List all secret folders
      description: Get a list of all configured secret folders.
      responses:
        "200":
          description: a list of secret folder objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretFolderWithRuntimeState"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/secret-folders/{id}:
    delete:
      operationId: deleteSecretFolderById
      tags:
        - secretFolders
      x-speakeasy-group: secrets.folders
      x-speakeasy-name-override: delete
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Delete a secret folder
      description: Delete the specified secret folder. The request will fail if the
        folder still contains secrets.
      responses:
        "200":
          description: The deleted SecretFolderWithRuntimeState object in a single-item
            list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretFolderWithRuntimeState"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Secret folder not found
        "409":
          description: Conflict — folder still contains secrets
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret folder to delete.
    get:
      operationId: getSecretFolderById
      tags:
        - secretFolders
      x-speakeasy-group: secrets.folders
      x-speakeasy-name-override: get
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get a secret folder
      description: Get the specified secret folder.
      responses:
        "200":
          description: List of SecretFolderWithRuntimeState objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretFolderWithRuntimeState"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: secret folder not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret folder to get.
    patch:
      operationId: updateSecretFolderById
      tags:
        - secretFolders
      x-speakeasy-group: secrets.folders
      x-speakeasy-name-override: update
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Update a secret folder
      description: Update the specified secret folder.<br/><br/>Provide a complete
        representation of the secret folder that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the secret
        folder.<br/><br/>Confirm that the configuration in your request body is
        correct before sending the request. If the configuration is incorrect,
        the updated secret folder might not function as expected.
      responses:
        "200":
          description: The updated SecretFolderWithRuntimeState object in a single-item
            list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretFolderWithRuntimeState"
        "400":
          description: Bad Request — invalid request body
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: secret folder not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SecretFolderUpdate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SecretFolderUpdate"
            examples:
              UpdateSecretFolderExamplesUpdateDescriptionAndSharing:
                $ref: "#/components/examples/UpdateSecretFolderExamplesUpdateDescriptionAndShar\
                  ing"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret folder to update.
  /system/secret-folders/{id}/reload:
    post:
      operationId: createSecretFolderReloadById
      tags:
        - secretFolders
      x-speakeasy-group: secrets.folders
      x-speakeasy-name-override: reload
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Reload a secret folder
      description: Re-fetch all secrets in the specified secret folder from its
        backing secret store. Invalidates the resolved-value cache for the
        folder and updates <code>lastReloadAt</code>.
      responses:
        "200":
          description: Returns <code>ISecretFolderReloadResponse</code> with HTTP 200 for
            all outcomes; when <code>success</code> is <code>false</code>, the
            reload did not complete (missing folder or backing-store failure).
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretFolderReloadResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret folder to reload.
  /system/secret-stores:
    post:
      operationId: createSecretStore
      tags:
        - secretStores
      x-speakeasy-group: secrets.stores
      x-speakeasy-name-override: create
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Create a secret store
      description: Create a new secret store.
      responses:
        "200":
          description: The created SecretStoreWithRuntimeState object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretStoreWithRuntimeState"
        "400":
          description: Bad Request — invalid request body or unsupported built-in store
            creation
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SecretStoreCreate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SecretStoreCreate"
            examples:
              CreateSecretStoreExamplesVaultSecretStore:
                $ref: "#/components/examples/CreateSecretStoreExamplesVaultSecretStore"
    get:
      operationId: getSecretStore
      tags:
        - secretStores
      x-speakeasy-group: secrets.stores
      x-speakeasy-name-override: list
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List all secret stores
      description: Get a list of all configured secret stores.
      responses:
        "200":
          description: a list of secret store objects
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretStoreWithRuntimeState"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/secret-stores/{id}:
    delete:
      operationId: deleteSecretStoreById
      tags:
        - secretStores
      x-speakeasy-group: secrets.stores
      x-speakeasy-name-override: delete
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Delete a secret store
      description: Delete the specified secret store.<br/><br/>The built-in Cribl
        secret store cannot be deleted.
      responses:
        "200":
          description: The deleted SecretStoreWithRuntimeState object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretStoreWithRuntimeState"
        "400":
          description: Bad Request — built-in Cribl secret store cannot be deleted
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: secret store not found
        "409":
          description: Conflict — folders still reference the secret store
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret store to delete.
    get:
      operationId: getSecretStoreById
      tags:
        - secretStores
      x-speakeasy-group: secrets.stores
      x-speakeasy-name-override: get
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get a secret store
      description: Get the specified secret store.
      responses:
        "200":
          description: List of SecretStoreWithRuntimeState objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretStoreWithRuntimeState"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: secret store not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret store to get.
    patch:
      operationId: updateSecretStoreById
      tags:
        - secretStores
      x-speakeasy-group: secrets.stores
      x-speakeasy-name-override: update
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Update a secret store
      description: Update the specified secret store.<br/><br/>Provide a complete
        representation of the secret store that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the secret
        store.<br/><br/>Confirm that the configuration in your request body is
        correct before sending the request. If the configuration is incorrect,
        the updated secret store might not function as expected.
      responses:
        "200":
          description: The updated SecretStoreWithRuntimeState object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSecretStoreWithRuntimeState"
        "400":
          description: Bad Request — invalid request body or unsupported built-in store
            update
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: secret store not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SecretStoreUpdate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SecretStoreUpdate"
            examples:
              UpdateSecretStoreExamplesUpdateVaultSecretStore:
                $ref: "#/components/examples/UpdateSecretStoreExamplesUpdateVaultSecretStore"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the secret store to update.
  /system/instance:
    get:
      operationId: listInstanceSettingsSchema
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - system
      summary: Get a list of InstanceSettingsSchema objects
      description: Get a list of InstanceSettingsSchema objects.
      responses:
        "200":
          description: List of InstanceSettingsSchema objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedInstanceSettingsSchema"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/teams:
    post:
      operationId: createTeam
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - teams
      summary: Create a Team
      description: Create a new Team.
      requestBody:
        description: Team object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Team"
            examples:
              CreateTeamExamplesEngineeringTeam:
                $ref: "#/components/examples/CreateTeamExamplesEngineeringTeam"
      responses:
        "200":
          description: The created Team object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedTeam"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    get:
      operationId: getTeam
      tags:
        - teams
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Teams
      description: Get a list of Team objects.
      responses:
        "200":
          description: List of Team objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedTeam"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/ProductsExtended"
          description: filter teams by product
  /system/teams/{id}:
    get:
      operationId: getTeamById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - teams
      summary: Get Team by ID
      description: Get Team by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Team objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedTeam"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateTeamById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - teams
      summary: Update a Team
      description: Update the specified Team.<br/><br/>Provide a complete
        representation of the Team that you want to update in the request body.
        This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Team.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Team might not
        function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Team to update.
      requestBody:
        description: Team object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Team"
            examples:
              UpdateTeamExamplesUpdateTeamRoles:
                $ref: "#/components/examples/UpdateTeamExamplesUpdateTeamRoles"
      responses:
        "200":
          description: The updated Team object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedTeam"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteTeamById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - teams
      summary: Delete Team
      description: Delete Team.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted Team object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedTeam"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/teams/{id}/acl:
    get:
      operationId: getTeamAclById
      tags:
        - teams
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get Team Access Control List
      description: Get Teams's Access Control List.
      responses:
        "200":
          description: List of ResourcePolicy objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedResourcePolicy"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Team name
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/RbacResource"
          description: resource type by which to filter access levels
  /system/teams/users/{id}/roles:
    get:
      operationId: getTeamRolesById
      tags:
        - teams
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List user Roles
      description: Get user's product roles.
      responses:
        "200":
          description: List of string objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: user id
  /system/teams/{id}/users:
    get:
      operationId: getTeamUsersById
      tags:
        - teams
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List Team Members
      description: Get users on a team.
      responses:
        "200":
          description: List of string objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Team Name
    post:
      operationId: createTeamUsersById
      tags:
        - teams
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update Team Membership
      description: Add or remove Members from the specified Team.
      responses:
        "200":
          description: The created string object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: MembershipSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MembershipSchema"
            examples:
              UpdateTeamUsersExamplesAddUsers:
                $ref: "#/components/examples/UpdateTeamUsersExamplesAddUsers"
              UpdateTeamUsersExamplesRemoveUsers:
                $ref: "#/components/examples/UpdateTeamUsersExamplesRemoveUsers"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Team to update membership for.
  /system/users:
    get:
      operationId: listUser
      x-cribl-internal: false
      x-cribl-availability: onprem
      x-speakeasy-name-override: list
      tags:
        - users
      summary: Get a list of User objects (on-prem only)
      description: Get a list of User objects (on-prem only).
      responses:
        "200":
          description: List of User objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUser"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createUser
      x-cribl-internal: false
      x-cribl-availability: onprem
      x-speakeasy-name-override: create
      tags:
        - users
      summary: Create a User (on-prem only)
      description: Create a new User (on-prem only).
      requestBody:
        description: User object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/User"
            examples:
              CreateUserExamplesBasicUser:
                $ref: "#/components/examples/CreateUserExamplesBasicUser"
      responses:
        "200":
          description: The created User object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUser"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/users/{id}:
    get:
      operationId: getUserById
      x-cribl-internal: false
      x-cribl-availability: onprem
      x-speakeasy-name-override: get
      tags:
        - users
      summary: Get User by ID (on-prem only)
      description: Get User by ID (on-prem only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of User objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUser"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateUserById
      x-cribl-internal: false
      x-cribl-availability: onprem
      x-speakeasy-name-override: update
      tags:
        - users
      summary: Update a User (on-prem only)
      description: Update the specified User (on-prem only).<br/><br/>Provide a
        complete representation of the User that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the User.<br/><br/>Confirm that
        the configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated User might not
        function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the User to update.
      requestBody:
        description: UserProfile object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UserProfile"
            examples:
              UpdateUserExamplesUpdateUserRoles:
                $ref: "#/components/examples/UpdateUserExamplesUpdateUserRoles"
      responses:
        "200":
          description: The updated UserProfile object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserProfile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteUserById
      x-cribl-internal: false
      x-cribl-availability: onprem
      x-speakeasy-name-override: delete
      tags:
        - users
      summary: Delete User (on-prem only)
      description: Delete User (on-prem only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted User object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUser"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/users/{id}/info:
    patch:
      operationId: updateUserInfoById
      tags:
        - users
      x-cribl-internal: false
      x-cribl-availability: onprem
      summary: Update User information (on-prem only)
      description: Update the specified User's profile information (except for
        assigned Roles) (on-prem only).<br/><br/>Provide a complete
        representation of the User that you want to update in the request body.
        This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the User.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated User might not
        function as expected.
      responses:
        "200":
          description: The updated User object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUser"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: UserInfo object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UserInfo"
            examples:
              UpdateUserInfoExamplesUpdateOwnProfile:
                $ref: "#/components/examples/UpdateUserInfoExamplesUpdateOwnProfile"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the User to update.
  /ai/sessions/{agentSlug}:
    get:
      operationId: listSessionByAgentSlug
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - AI
      summary: List AI sessions for an agent
      description: List metadata for all AI sessions owned by the specified agent slug.
      responses:
        "200":
          description: List of Session objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSession"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: agentSlug
          in: path
          required: true
          schema:
            type: string
          description: The agent slug whose sessions to list.
    post:
      operationId: createSessionByAgentSlug
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - AI
      summary: Create an AI session
      description: Create a new AI session under the specified agent slug.
      requestBody:
        description: New Session object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Session"
      responses:
        "200":
          description: The created Session object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSession"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: agentSlug
          in: path
          required: true
          schema:
            type: string
          description: The agent slug that will own the session.
  /ai/sessions/{agentSlug}/{id}:
    get:
      operationId: getSessionByAgentSlugAndId
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - AI
      summary: Get an AI session
      description: Get the specified AI session under the given agent slug.
      parameters:
        - name: agentSlug
          in: path
          required: true
          schema:
            type: string
          description: The agent slug that owns the session.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the session to fetch.
      responses:
        "200":
          description: List of Session objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSession"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Session not found or caller is not the owner
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSessionByAgentSlugAndId
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - AI
      summary: Update an AI session
      description: Upsert the specified AI session under the given agent slug.
      parameters:
        - name: agentSlug
          in: path
          required: true
          schema:
            type: string
          description: The agent slug that owns the session.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the session to update.
      requestBody:
        description: Session object to be updated.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Session"
      responses:
        "200":
          description: The updated Session object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSession"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Session not found or caller is not the owner
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteSessionByAgentSlugAndId
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - AI
      summary: Delete an AI session
      description: Delete the specified AI session under the given agent slug.
      parameters:
        - name: agentSlug
          in: path
          required: true
          schema:
            type: string
          description: The agent slug that owns the session.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the session to delete.
      responses:
        "200":
          description: The deleted Session object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSession"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Session not found or caller is not the owner
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /products/lake/lakes/{lakeId}/buckets:
    post:
      operationId: createCriblLakeBucketByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.buckets
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Create a Cribl Lake bucket (Cribl.Cloud only)
      description: Create a new Cribl Lake bucket in the specified Lake (Cribl.Cloud only).
      responses:
        "200":
          description: The created CriblLakeBucket object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeBucket"
        "400":
          description: Invalid bucket type, region, or policy
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Insufficient license
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeBucket object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeBucket"
            examples:
              LakeBucketCreateExamplesDdssBucket:
                $ref: "#/components/examples/LakeBucketCreateExamplesDdssBucket"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake to create the Cribl Lake bucket in.
    get:
      operationId: getCriblLakeBucketByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.buckets
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List all Cribl Lake buckets (Cribl.Cloud only)
      description: Get a list of all Cribl Lake buckets in the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: List of CriblLakeBucket objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeBucket"
        "400":
          description: Invalid bucket type
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Insufficient license
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Cribl Lake buckets.
        - name: bucketType
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/PublicLakeBucketType"
          description: Type of Cribl Lake buckets to include in the results.
  /products/lake/lakes/{lakeId}/buckets/{id}:
    delete:
      operationId: deleteCriblLakeBucketByLakeIdAndId
      tags:
        - lake
      x-speakeasy-group: lakes.buckets
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete a Cribl Lake bucket (Cribl.Cloud only)
      description: Delete the specified Cribl Lake bucket in the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: The deleted CriblLakeBucket object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeBucket"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Insufficient license
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Cribl Lake bucket
            to delete.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Cribl Lake bucket to delete.
        - name: force
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, force-delete the Cribl Lake bucket even if it
            contains data.
    get:
      operationId: getCriblLakeBucketByLakeIdAndId
      tags:
        - lake
      x-speakeasy-group: lakes.buckets
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get a Cribl Lake bucket (Cribl.Cloud only)
      description: Get the specified Cribl Lake bucket in the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: List of CriblLakeBucket objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeBucket"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Insufficient license
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Cribl Lake bucket.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Cribl Lake bucket to get.
    patch:
      operationId: updateCriblLakeBucketByLakeIdAndId
      tags:
        - lake
      x-speakeasy-group: lakes.buckets
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update a Cribl Lake bucket (Cribl.Cloud only)
      description: Update the specified Cribl Lake bucket in the specified Lake
        (Cribl.Cloud only).<br/><br/>Provide a complete representation of the
        Cribl Lake bucket that you want to update in the request body. This
        endpoint does not support partial updates. Cribl removes any omitted
        fields when updating the Cribl Lake bucket.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Cribl Lake
        bucket might not function as expected.
      responses:
        "200":
          description: The updated CriblLakeBucket object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeBucket"
        "400":
          description: Attempted to modify a read-only field
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Insufficient license
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeBucket object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeBucket"
            examples:
              LakeBucketUpdateExamplesUpdateDescription:
                $ref: "#/components/examples/LakeBucketUpdateExamplesUpdateDescription"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Cribl Lake bucket
            to update.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Cribl Lake bucket to update.
  /products/lake/lakes/{lakeId}/config:
    get:
      operationId: getLakeConfigItemConfigByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.configs
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List all configuration limits for a Lake (Cribl.Cloud only)
      description: Get a list of all configuration limits for the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: List of LakeConfigItem objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLakeConfigItem"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake to get configuration limits for.
  /products/lake/lakes/{lakeId}/config/{configId}:
    get:
      operationId: getLakeConfigItemConfigByLakeIdAndConfigId
      tags:
        - lake
      x-speakeasy-group: lakes.configs
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get a configuration limit for a Lake (Cribl.Cloud only)
      description: Get the specified configuration limit for the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: List of LakeConfigItem objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLakeConfigItem"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake to get the configuration limit for.
        - name: configId
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ConfigType"
          description: The <code>id</code> of the configuration limit to get.
  /products/lake/lakes/{lakeId}/datasets:
    patch:
      operationId: updateCriblLakeDatasetByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.datasets
      x-speakeasy-name-override: bulkUpdate
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Updates a list of Lake Datasets in a Lake (Cribl.Cloud only)
      description: Updates a list of Lake Datasets in the specified Lake (Cribl.Cloud only).
      responses:
        "200":
          description: The updated CriblLakeDataset object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeDataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeDataset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeDataset"
            examples:
              LakeDatasetBulkUpdateExamplesBulkUpdateRetention:
                $ref: "#/components/examples/LakeDatasetBulkUpdateExamplesBulkUpdateRetention"
              LakeDatasetBulkUpdateExamplesBulkUpdateDescription:
                $ref: "#/components/examples/LakeDatasetBulkUpdateExamplesBulkUpdateDescription"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Lake Datasets to
            update.
    post:
      operationId: createCriblLakeDatasetByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.datasets
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Create a Lake Dataset (Cribl.Cloud only)
      description: Create a new Lake Dataset in the specified Lake (Cribl.Cloud only).
      responses:
        "200":
          description: The created CriblLakeDataset object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeDataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeDataset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeDataset"
            examples:
              LakeDatasetCreateExamplesJsonDataset:
                $ref: "#/components/examples/LakeDatasetCreateExamplesJsonDataset"
              LakeDatasetCreateExamplesParquetDataset:
                $ref: "#/components/examples/LakeDatasetCreateExamplesParquetDataset"
              LakeDatasetCreateExamplesMinimalDataset:
                $ref: "#/components/examples/LakeDatasetCreateExamplesMinimalDataset"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake to create the Lake Dataset in.
    get:
      operationId: getCriblLakeDatasetByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.datasets
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List all Lake Datasets (Cribl.Cloud only)
      description: Get a list of all Lake Datasets in the specified Lake (Cribl.Cloud only).
      responses:
        "200":
          description: List of CriblLakeDataset objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeDataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Lake Datasets to
            list.
        - name: storageLocationId
          in: query
          required: false
          schema:
            type: string
          description: Filter datasets by storage location ID. Use <code>default</code>
            for default storage location.
        - name: format
          in: query
          required: false
          schema:
            type: string
            enum:
              - ddss
            x-speakeasy-unknown-values: allow
          description: Filter datasets by format. Set to <code>ddss</code> to return only
            DDSS datasets.
        - name: excludeDDSS
          in: query
          required: false
          schema:
            type: boolean
          description: Exclude DDSS format datasets from the response.
        - name: excludeNetskope
          in: query
          required: false
          schema:
            type: boolean
          description: Exclude Netskope format datasets from the response.
        - name: excludeDeleted
          in: query
          required: false
          schema:
            type: boolean
          description: Exclude deleted datasets from the response.
        - name: excludeInternal
          in: query
          required: false
          schema:
            type: boolean
          description: Exclude internal datasets (those with IDs starting with
            <code>cribl_</code>) from the response.
        - name: excludeBYOS
          in: query
          required: false
          schema:
            type: boolean
          description: Exclude BYOS (Bring Your Own Storage) datasets from the response.
        - name: includeMetrics
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include storage metrics for each Lake
            Dataset. Otherwise, <code>false</code> (default). Requires a Cribl
            Lake metrics license.
  /products/lake/lakes/{lakeId}/datasets/{id}:
    delete:
      operationId: deleteCriblLakeDatasetByLakeIdAndId
      tags:
        - lake
      x-speakeasy-group: lakes.datasets
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete a Lake Dataset (Cribl.Cloud only)
      description: Delete the specified Lake Dataset in the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: The deleted CriblLakeDataset object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeDataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Lake Dataset to
            delete.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake Dataset to delete.
    get:
      operationId: getCriblLakeDatasetByLakeIdAndId
      tags:
        - lake
      x-speakeasy-group: lakes.datasets
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get a Lake Dataset (Cribl.Cloud only)
      description: Get the specified Lake Dataset in the specified Lake (Cribl.Cloud only).
      responses:
        "200":
          description: List of CriblLakeDataset objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeDataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Lake Dataset to
            get.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake Dataset to get.
        - name: includeMetrics
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> to include storage metrics for each Lake
            Dataset. Otherwise, <code>false</code> (default). Requires a Cribl
            Lake metrics license.
    patch:
      operationId: updateCriblLakeDatasetByLakeIdAndId
      tags:
        - lake
      x-speakeasy-group: lakes.datasets
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update a Lake Dataset (Cribl.Cloud only)
      description: Update the specified Lake Dataset in the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: The updated CriblLakeDataset object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeDataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeDatasetUpdate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeDatasetUpdate"
            examples:
              LakeDatasetUpdateExamplesUpdateRetention:
                $ref: "#/components/examples/LakeDatasetUpdateExamplesUpdateRetention"
              LakeDatasetUpdateExamplesUpdateDescription:
                $ref: "#/components/examples/LakeDatasetUpdateExamplesUpdateDescription"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Lake Dataset to
            update.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake Dataset to update.
  /products/lake/lakes/{lakeId}/direct-access:
    post:
      operationId: createCriblLakeDirectAccessItemDirectAccessByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.directAccesses
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Create a Direct Access HTTP Source for a Lake (Cribl.Cloud only)
      description: Create a new Direct Access HTTP Source for the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: The created CriblLakeDirectAccessItem object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeDirectAccessItem"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeDirectAccessItem object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeDirectAccessItem"
            examples:
              LakeDirectAccessCreateExamplesNdjsonToken:
                $ref: "#/components/examples/LakeDirectAccessCreateExamplesNdjsonToken"
              LakeDirectAccessCreateExamplesHecToken:
                $ref: "#/components/examples/LakeDirectAccessCreateExamplesHecToken"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake to create the Direct Access HTTP
            Source in.
    delete:
      operationId: deleteCriblLakeDirectAccessItemDirectAccessByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.directAccesses
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete the Lake Direct Access HTTP Source for a Lake (Cribl.Cloud only)
      description: Delete the Direct Access HTTP Source for the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: The deleted CriblLakeDirectAccessItem object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeDirectAccessItem"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Direct Access
            Source to delete.
    get:
      operationId: getCriblLakeDirectAccessItemDirectAccessByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.directAccesses
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get the Direct Access HTTP Source for a Lake (Cribl.Cloud only)
      description: Get the Direct Access HTTP Source for the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: List of CriblLakeDirectAccessItem objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeDirectAccessItem"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake to get the Direct Access HTTP
            Source for.
    put:
      operationId: updateCriblLakeDirectAccessItemDirectAccessByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.directAccesses
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update the Direct Access HTTP Source for a Lake (Cribl.Cloud only)
      description: Update the Direct Access HTTP Source for the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: The updated CriblLakeDirectAccessItem object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeDirectAccessItem"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeDirectAccessItem object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeDirectAccessItem"
            examples:
              LakeDirectAccessUpdateExamplesUpdateAuthTokens:
                $ref: "#/components/examples/LakeDirectAccessUpdateExamplesUpdateAuthTokens"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Direct Access
            HTTP Source to update.
  /products/lake/lakes/{lakeId}/storage-locations:
    post:
      operationId: createCriblLakeStorageLocationByLakeId
      tags:
        - lake
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Create a Storage Location (Cribl.Cloud only)
      description: Create a Storage Location in the specified Lake (Cribl.Cloud only).
      responses:
        "200":
          description: The created CriblLakeStorageLocation object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeStorageLocation"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeStorageLocation object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeStorageLocation"
            examples:
              LakeStorageLocationCreateExamplesAwsS3WithAutoCredentials:
                $ref: "#/components/examples/LakeStorageLocationCreateExamplesAwsS3WithAutoCred\
                  entials"
              LakeStorageLocationCreateExamplesAwsS3WithManualCredentials:
                $ref: "#/components/examples/LakeStorageLocationCreateExamplesAwsS3WithManualCr\
                  edentials"
              LakeStorageLocationCreateExamplesAzureBlob:
                $ref: "#/components/examples/LakeStorageLocationCreateExamplesAzureBlob"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake to create the Storage Location in.
    get:
      operationId: getCriblLakeStorageLocationByLakeId
      tags:
        - lake
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List all Storage Locations (Cribl.Cloud only)
      description: Get a list of all Storage Locations contained in the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: List of CriblLakeStorageLocation objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeStorageLocation"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Storage Locations.
  /products/lake/lakes/{lakeId}/storage-locations/{id}:
    delete:
      operationId: deleteCriblLakeStorageLocationByLakeIdAndId
      tags:
        - lake
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete a Storage Location (Cribl.Cloud only)
      description: Delete a Storage Location in the specified Lake (Cribl.Cloud only).
      responses:
        "200":
          description: The deleted CriblLakeStorageLocation object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeStorageLocation"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: lake id that contains the Storage Locations
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: storage location id to delete
    get:
      operationId: getCriblLakeStorageLocationByLakeIdAndId
      tags:
        - lake
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get a Storage Location (Cribl.Cloud only)
      description: Get the specified Storage Location in the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: List of CriblLakeStorageLocation objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeStorageLocation"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Storage Location.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Storage Location.
    patch:
      operationId: updateCriblLakeStorageLocationByLakeIdAndId
      tags:
        - lake
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update a Storage Location (Cribl.Cloud only)
      description: Update the specified Storage Location in the specified Lake
        (Cribl.Cloud only).
      responses:
        "200":
          description: The updated CriblLakeStorageLocation object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeStorageLocation"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeStorageLocationUpdate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeStorageLocationUpdate"
            examples:
              LakeStorageLocationUpdateExamplesUpdateCredentials:
                $ref: "#/components/examples/LakeStorageLocationUpdateExamplesUpdateCredentials"
              LakeStorageLocationUpdateExamplesUpdateDescription:
                $ref: "#/components/examples/LakeStorageLocationUpdateExamplesUpdateDescription"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Storage Location
            to update.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Storage Location to update.
  /products/lake/lakes/{lakeId}/storage-locations/{provider}/sp-status:
    get:
      operationId: getCriblLakeStorageLocationSpStatusByLakeIdAndProvider
      tags:
        - lake
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get service principal status (Cribl.Cloud only)
      description: Returns (Cribl.Cloud only).
      responses:
        "200":
          description: List of AzureSpStatus objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAzureSpStatus"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: lake id
        - name: provider
          in: path
          required: true
          schema:
            type: string
          description: cloud provider slug (must be azure_blob)
        - name: tenantId
          in: query
          required: true
          schema:
            type: string
          description: The Azure AD tenant ID of the customer.
  /products/lake/lakes/{lakeId}/storage-locations/{provider}/token:
    get:
      operationId: getCriblLakeStorageLocationTokenByLakeIdAndProvider
      tags:
        - lake
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get the principal object ID for the Cribl service principal
        (Cribl.Cloud only)
      description: Acquires an Azure access token and returns only the principal
        object ID extracted from the JWT (Cribl.Cloud only).
      responses:
        "200":
          description: List of AzurePrincipalObjectId objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAzurePrincipalObjectId"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: lake id
        - name: provider
          in: path
          required: true
          schema:
            type: string
          description: cloud provider slug (must be azure_blob)
        - name: tenantId
          in: query
          required: true
          schema:
            type: string
          description: The Azure AD tenant ID of the customer.
  /products/lake/lakes/{lakeId}/storage-locations/{provider}/info:
    get:
      operationId: getCriblLakeStorageLocationInfoByLakeIdAndProvider
      tags:
        - lake
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get Storage Location Provider Info (Cribl.Cloud only)
      description: Get provider-specific info for setting up a storage location, such
        as Azure SP IDs (Cribl.Cloud only).
      responses:
        "200":
          description: List of AzureSpIds objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAzureSpIds"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: lake id
        - name: provider
          in: path
          required: true
          schema:
            type: string
          description: cloud provider slug (e.g. azure_blob)
  /search/dashboard-categories:
    get:
      operationId: listDashboardCategory
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - dashboardCategories
      summary: List all Dashboard Collections
      description: Get a list of all Dashboard Collections.
      responses:
        "200":
          description: List of DashboardCategory objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDashboardCategory"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createDashboardCategory
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - dashboardCategories
      summary: Create a Dashboard Collection
      description: Create a new Dashboard Collection.
      requestBody:
        description: DashboardCategory object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DashboardCategory"
            examples:
              CreateDashboardCategoryExamplesSimpleCategory:
                $ref: "#/components/examples/CreateDashboardCategoryExamplesSimpleCategory"
      responses:
        "200":
          description: The created DashboardCategory object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDashboardCategory"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/dashboard-categories/{id}:
    get:
      operationId: getDashboardCategoryById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - dashboardCategories
      summary: Get a Dashboard Collection
      description: Get the specified Dashboard Collection.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard Collection to get.
      responses:
        "200":
          description: List of DashboardCategory objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDashboardCategory"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateDashboardCategoryById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - dashboardCategories
      summary: Update a Dashboard Collection
      description: Update the specified Dashboard Collection.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard Collection to update.
      requestBody:
        description: DashboardCategory object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DashboardCategory"
            examples:
              UpdateDashboardCategoryExamplesUpdateCategory:
                $ref: "#/components/examples/UpdateDashboardCategoryExamplesUpdateCategory"
      responses:
        "200":
          description: The updated DashboardCategory object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDashboardCategory"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteDashboardCategoryById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - dashboardCategories
      summary: Delete a Dashboard Collection
      description: Delete the specified Dashboard Collection.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dashboard Collection to delete.
      responses:
        "200":
          description: The deleted DashboardCategory object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDashboardCategory"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/datatypes:
    get:
      operationId: listDataTypeDescriptor
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: list
      tags:
        - datatypes
      summary: List Datatypes (Cribl.Cloud only)
      description: Get a list of all Cribl Search Datatypes (Cribl.Cloud only).
      responses:
        "200":
          description: Datatypes available for Search
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataTypeDescriptor"
              examples:
                DatatypeListResponseExamplesNdjsonRow:
                  $ref: "#/components/examples/DatatypeListResponseExamplesNdjsonRow"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.datatypes
    post:
      operationId: createDataTypeDescriptor
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: create
      tags:
        - datatypes
      summary: Create a Datatype (Cribl.Cloud only)
      description: Create a new Datatype (Cribl.Cloud only).
      requestBody:
        description: DataTypeDescriptor object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataTypeDescriptor"
            examples:
              DatatypeCreateExamplesMinimalNdjson:
                $ref: "#/components/examples/DatatypeCreateExamplesMinimalNdjson"
              DatatypeCreateExamplesNdjsonManualTimestamp:
                $ref: "#/components/examples/DatatypeCreateExamplesNdjsonManualTimestamp"
              DatatypeCreateExamplesNdjsonWithAdditionalExtraction:
                $ref: "#/components/examples/DatatypeCreateExamplesNdjsonWithAdditionalExtracti\
                  on"
              DatatypeCreateExamplesJsonArray:
                $ref: "#/components/examples/DatatypeCreateExamplesJsonArray"
              DatatypeCreateExamplesRawOpaque:
                $ref: "#/components/examples/DatatypeCreateExamplesRawOpaque"
              DatatypeCreateExamplesKvpSpaceEquals:
                $ref: "#/components/examples/DatatypeCreateExamplesKvpSpaceEquals"
              DatatypeCreateExamplesXmlMinimal:
                $ref: "#/components/examples/DatatypeCreateExamplesXmlMinimal"
              DatatypeCreateExamplesXmlWindowsEvent:
                $ref: "#/components/examples/DatatypeCreateExamplesXmlWindowsEvent"
              DatatypeCreateExamplesWithDescription:
                $ref: "#/components/examples/DatatypeCreateExamplesWithDescription"
              DatatypeCreateExamplesParquetLake:
                $ref: "#/components/examples/DatatypeCreateExamplesParquetLake"
              DatatypeCreateExamplesNdjsonWithMaxEventBytes:
                $ref: "#/components/examples/DatatypeCreateExamplesNdjsonWithMaxEventBytes"
      responses:
        "200":
          description: The created datatype
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataTypeDescriptor"
              examples:
                DatatypeListResponseExamplesNdjsonRow:
                  $ref: "#/components/examples/DatatypeListResponseExamplesNdjsonRow"
        "400":
          description: Validation error.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.datatypes
  /search/datatypes/{id}:
    get:
      operationId: getDataTypeDescriptorById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: get
      tags:
        - datatypes
      summary: Get a Datatype (Cribl.Cloud only)
      description: Get the specified Datatype (Cribl.Cloud only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Datatype.
      responses:
        "200":
          description: The requested datatype
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataTypeDescriptor"
              examples:
                DatatypeListResponseExamplesNdjsonRow:
                  $ref: "#/components/examples/DatatypeListResponseExamplesNdjsonRow"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.datatypes
    patch:
      operationId: updateDataTypeDescriptorById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: update
      tags:
        - datatypes
      summary: Update a Datatype (Cribl.Cloud only)
      description: Update the specified Datatype (Cribl.Cloud only).<br/><br/>Provide
        a complete representation of the Datatype that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Datatype.<br/><br/>Confirm
        that the configuration in your request body is correct before sending
        the request. If the configuration is incorrect, the updated Datatype
        might not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Datatype to update.
      requestBody:
        description: DataTypeDescriptor object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DataTypeDescriptor"
            examples:
              DatatypeUpdateExamplesUpdateMetadata:
                $ref: "#/components/examples/DatatypeUpdateExamplesUpdateMetadata"
              DatatypeUpdateExamplesUpdateMaxEventBytes:
                $ref: "#/components/examples/DatatypeUpdateExamplesUpdateMaxEventBytes"
              DatatypeUpdateExamplesUpdateSchemaMapAndAddFields:
                $ref: "#/components/examples/DatatypeUpdateExamplesUpdateSchemaMapAndAddFields"
      responses:
        "200":
          description: The updated datatype
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataTypeDescriptor"
              examples:
                DatatypeListResponseExamplesNdjsonRow:
                  $ref: "#/components/examples/DatatypeListResponseExamplesNdjsonRow"
        "400":
          description: Validation error (invalid datatype configuration).
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.datatypes
    delete:
      operationId: deleteDataTypeDescriptorById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: delete
      tags:
        - datatypes
      summary: Delete a Datatype (Cribl.Cloud only)
      description: Delete the specified Datatype (Cribl.Cloud only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Datatype to delete.
      responses:
        "200":
          description: The deleted datatype
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataTypeDescriptor"
              examples:
                DatatypeListResponseExamplesNdjsonRow:
                  $ref: "#/components/examples/DatatypeListResponseExamplesNdjsonRow"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.datatypes
  /search/notebooks:
    get:
      operationId: listNotebook
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - notebooks
      summary: List all Notebooks
      description: Get a list of all Notebooks.
      responses:
        "200":
          description: List of Notebook objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebook"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: datasetIds
          in: query
          required: false
          schema:
            type: array
            items:
              type: string
          description: List of <code>id</code> values for Datasets (maximum of 10). Limits
            the response to only Notebooks that reference the specified
            Datasets.
    post:
      operationId: createNotebook
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - notebooks
      summary: Create a Notebook
      description: Create a new Notebook.
      requestBody:
        description: Notebook object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Notebook"
            examples:
              CreateNotebookExamplesSimpleNotebook:
                $ref: "#/components/examples/CreateNotebookExamplesSimpleNotebook"
      responses:
        "200":
          description: The created Notebook object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebook"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/notebooks/{id}:
    get:
      operationId: getNotebookById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - notebooks
      summary: Get a Notebook
      description: Get the specified Notebook.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notebook to get.
      responses:
        "200":
          description: List of Notebook objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebook"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateNotebookById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - notebooks
      summary: Update a Notebook
      description: Update the specified Notebook.<br/><br/>Provide a complete
        representation of the Notebook that you want to update in the request
        body. This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the Notebook.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Notebook might
        not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notebook to update.
      requestBody:
        description: Notebook object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Notebook"
            examples:
              UpdateNotebookExamplesUpdateNotebook:
                $ref: "#/components/examples/UpdateNotebookExamplesUpdateNotebook"
      responses:
        "200":
          description: The updated Notebook object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebook"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteNotebookById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - notebooks
      summary: Delete a Notebook
      description: Delete the specified Notebook.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notebook to delete.
      responses:
        "200":
          description: The deleted Notebook object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebook"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/notebooks/{id}/acl:
    get:
      operationId: getNotebookAclById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Get
      description: List accesses to Notebook granted to users (Cribl.Cloud only).
      summary: Get Notebook ACL (Cribl.Cloud only)
      tags:
        - notebooks
  /search/notebooks/{id}/acl/apply:
    post:
      operationId: createNotebookAclApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclApplyNotebookExamplesGrantAccess:
                $ref: "#/components/examples/AclApplyNotebookExamplesGrantAccess"
              AclApplyNotebookExamplesRevokeAccess:
                $ref: "#/components/examples/AclApplyNotebookExamplesRevokeAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Create
      description: Add/remove accesses to Notebook for users (Cribl.Cloud only).
      summary: Modify Notebook ACL (Cribl.Cloud only)
      tags:
        - notebooks
  /search/notebooks/{id}/acl/teams:
    get:
      operationId: getNotebookAclTeamsById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Get
      description: List accesses to Notebook granted to Teams (Cribl.Cloud only).
      summary: Get Notebook Teams (Cribl.Cloud only)
      tags:
        - notebooks
  /search/notebooks/{id}/acl/teams/apply:
    post:
      operationId: createNotebookAclTeamsApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclTeamsApplyNotebookExamplesGrantTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyNotebookExamplesGrantTeamAccess"
              AclTeamsApplyNotebookExamplesRevokeTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyNotebookExamplesRevokeTeamAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Create
      description: Add/remove accesses to Notebook for Teams (Cribl.Cloud only).
      summary: Modify Notebook Teams ACL (Cribl.Cloud only)
      tags:
        - notebooks
  /search/notebooks/{id}/activity:
    get:
      operationId: getNotebookActivityById
      tags:
        - notebooks
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get Notebook activity history (Cribl.Cloud only)
      description: Get the activity history for the specified Notebook (Cribl.Cloud only).
      responses:
        "200":
          description: List of NotebookActivityResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNotebookActivityResult"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Not Found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notebook.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of activity events to return in the response for
            this request. Use with <code>offset</code> to paginate the response
            into manageable batches. Default is <code>50</code>, maximum is
            <code>1000</code>.
        - name: offset
          in: query
          required: false
          schema:
            type: string
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: et
          in: query
          required: false
          schema:
            type: integer
          description: Timestamp (in Unix time) of the earliest activity event to include
            in the response for this request, in seconds.
        - name: lt
          in: query
          required: false
          schema:
            type: integer
          description: Timestamp (in Unix time) of the latest activity event to include in
            the response for this request, in seconds.
        - name: filter
          in: query
          required: false
          schema:
            type: string
          description: Filter expression to evaluate against activity events for inclusion
            in the response to this request.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
    post:
      operationId: createNotebookActivityById
      tags:
        - notebooks
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Log Notebook activity (Cribl.Cloud only)
      description: Log an activity event for the specified Notebook (Cribl.Cloud only).
      responses:
        "204":
          description: No Content on success
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Not Found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: NotebookActivityEventInput object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/NotebookActivityEventInput"
            examples:
              LogNotebookActivityExamplesViewActivity:
                $ref: "#/components/examples/LogNotebookActivityExamplesViewActivity"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Notebook.
  /search/usage-groups:
    post:
      operationId: createUsageGroup
      tags:
        - usage-groups
      x-speakeasy-group: search.usageGroups
      x-speakeasy-name-override: create
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Create a Usage Group (Cribl.Cloud only)
      description: Create a new Usage Group (Cribl.Cloud only).
      responses:
        "200":
          description: The created usage group
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUsageGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: UsageGroup object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UsageGroup"
            examples:
              UsageGroupCreateExamplesWithRules:
                $ref: "#/components/examples/UsageGroupCreateExamplesWithRules"
              UsageGroupCreateExamplesWithExecutionCaps:
                $ref: "#/components/examples/UsageGroupCreateExamplesWithExecutionCaps"
    get:
      operationId: getUsageGroup
      tags:
        - usage-groups
      x-speakeasy-group: search.usageGroups
      x-speakeasy-name-override: list
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: List Usage Groups (Cribl.Cloud only)
      description: List all Usage Groups (Cribl.Cloud only).
      responses:
        "200":
          description: Usage groups visible to the caller
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUsageGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of Usage Groups to return in the response for this
            request. Use with <code>offset</code> to paginate the response into
            manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /search/usage-groups/{id}:
    delete:
      operationId: deleteUsageGroupById
      tags:
        - usage-groups
      x-speakeasy-group: search.usageGroups
      x-speakeasy-name-override: delete
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Delete a Usage Group (Cribl.Cloud only)
      description: Delete the specified Usage Group (Cribl.Cloud only). Default and
        system usage groups cannot be deleted.
      responses:
        "200":
          description: The deleted usage group
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUsageGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Usage Group to delete.
    get:
      operationId: getUsageGroupById
      tags:
        - usage-groups
      x-speakeasy-group: search.usageGroups
      x-speakeasy-name-override: get
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Get a Usage Group (Cribl.Cloud only)
      description: Get the specified Usage Group (Cribl.Cloud only).
      responses:
        "200":
          description: The requested usage group
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUsageGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Usage Group.
    patch:
      operationId: updateUsageGroupById
      tags:
        - usage-groups
      x-speakeasy-group: search.usageGroups
      x-speakeasy-name-override: update
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Update a Usage Group (Cribl.Cloud only)
      description: Update the specified Usage Group (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the Usage Group
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the Usage Group.<br/><br/>Confirm that the configuration in your request
        body is correct before sending the request. If the configuration is
        incorrect, the updated Usage Group might not function as expected.
      responses:
        "200":
          description: The updated usage group
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUsageGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: UsageGroup object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UsageGroup"
            examples:
              UsageGroupUpdateExamplesUpdateDescription:
                $ref: "#/components/examples/UsageGroupUpdateExamplesUpdateDescription"
              UsageGroupUpdateExamplesAdjustLimits:
                $ref: "#/components/examples/UsageGroupUpdateExamplesAdjustLimits"
              UsageGroupUpdateExamplesDisableGroup:
                $ref: "#/components/examples/UsageGroupUpdateExamplesDisableGroup"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Usage Group.
  /search/dataset-provider-types/{id}:
    get:
      operationId: getDatasetProviderTypeById
      tags:
        - datasets
      x-speakeasy-group: search.datasets.providers.types
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get a Dataset Provider Type (Cribl.Cloud only)
      description: Get the specified Dataset Provider Type (Cribl.Cloud only).
      responses:
        "200":
          description: List of DatasetProviderType objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetProviderType"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset Provider Type to get.
    patch:
      operationId: updateDatasetProviderTypeById
      tags:
        - datasets
      x-speakeasy-group: search.datasets.providers.types
      x-speakeasy-name-override: update
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Update a Dataset Provider Type (Cribl.Cloud only)
      description: Update the specified Dataset Provider Type (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the Dataset
        Provider Type that you want to update in the request body. This endpoint
        does not support partial updates. Cribl removes any omitted fields when
        updating the Dataset Provider Type.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated Dataset Provider
        Type might not function as expected.
      responses:
        "200":
          description: The updated DatasetProviderType object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetProviderType"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset Provider Type to update.
  /search/dataset-provider-types:
    get:
      operationId: getDatasetProviderType
      tags:
        - datasets
      x-speakeasy-group: search.datasets.providers.types
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List all Dataset Provider Types (Cribl.Cloud only)
      description: Get a list of all Dataset Provider Types (Cribl.Cloud only).
      responses:
        "200":
          description: List of DatasetProviderType objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetProviderType"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/dataset-providers:
    get:
      operationId: listDatasetProvider
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: list
      tags:
        - datasets
      summary: List all Dataset Providers (Cribl.Cloud only)
      description: Get a list of all Dataset Providers (Cribl.Cloud only).
      responses:
        "200":
          description: Dataset Providers
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetProvider"
              examples:
                DatasetProviderResponseExampleDefault:
                  $ref: "#/components/examples/DatasetProviderResponseExampleDefault"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.datasets.providers
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of Dataset Providers to return in the response for
            this request. Use with <code>offset</code> to paginate the response
            into manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
    post:
      operationId: createDatasetProvider
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: create
      tags:
        - datasets
      summary: Create a Dataset Provider (Cribl.Cloud only)
      description: Create a new Dataset Provider (Cribl.Cloud only).
      requestBody:
        description: DatasetProvider object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatasetProvider"
            examples:
              DatasetProviderCreateExamplesAzureBlobConnectionString:
                $ref: "#/components/examples/DatasetProviderCreateExamplesAzureBlobConnectionSt\
                  ring"
              DatasetProviderCreateExamplesAzureBlobPrivateLink:
                $ref: "#/components/examples/DatasetProviderCreateExamplesAzureBlobPrivateLink"
              DatasetProviderCreateExamplesApiHttpMinimalCustomCatalog:
                $ref: "#/components/examples/DatasetProviderCreateExamplesApiHttpMinimalCustomC\
                  atalog"
              DatasetProviderCreateExamplesSnowflakeKeyPair:
                $ref: "#/components/examples/DatasetProviderCreateExamplesSnowflakeKeyPair"
              DatasetProviderCreateExamplesS3AssumeRole:
                $ref: "#/components/examples/DatasetProviderCreateExamplesS3AssumeRole"
              DatasetProviderCreateExamplesS3WithDescription:
                $ref: "#/components/examples/DatasetProviderCreateExamplesS3WithDescription"
              DatasetProviderCreateExamplesMinimalGcs:
                $ref: "#/components/examples/DatasetProviderCreateExamplesMinimalGcs"
              DatasetProviderCreateExamplesAmazonSecurityLakeAssumeRole:
                $ref: "#/components/examples/DatasetProviderCreateExamplesAmazonSecurityLakeAss\
                  umeRole"
              DatasetProviderCreateExamplesApiAzureServicePrincipal:
                $ref: "#/components/examples/DatasetProviderCreateExamplesApiAzureServicePrinci\
                  pal"
              DatasetProviderCreateExamplesApiHttpOAuthClientCredentials:
                $ref: "#/components/examples/DatasetProviderCreateExamplesApiHttpOAuthClientCre\
                  dentials"
              DatasetProviderCreateExamplesApiLogAnalyticsServicePrincipal:
                $ref: "#/components/examples/DatasetProviderCreateExamplesApiLogAnalyticsServic\
                  ePrincipal"
      responses:
        "200":
          description: The created Dataset Provider
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetProvider"
              examples:
                DatasetProviderResponseExampleDefault:
                  $ref: "#/components/examples/DatasetProviderResponseExampleDefault"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.datasets.providers
  /search/dataset-providers/{id}:
    get:
      operationId: getDatasetProviderById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: get
      tags:
        - datasets
      summary: Get a Dataset Provider (Cribl.Cloud only)
      description: Get the specified Dataset Provider (Cribl.Cloud only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset Provider.
      responses:
        "200":
          description: The requested Dataset Provider
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetProvider"
              examples:
                DatasetProviderResponseExampleDefault:
                  $ref: "#/components/examples/DatasetProviderResponseExampleDefault"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.datasets.providers
    patch:
      operationId: updateDatasetProviderById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: update
      tags:
        - datasets
      summary: Update a Dataset Provider (Cribl.Cloud only)
      description: Update the specified Dataset Provider (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the Dataset
        Provider that you want to update in the request body. This endpoint does
        not support partial updates. Cribl removes any omitted fields when
        updating the Dataset Provider.<br/><br/>Confirm that the configuration
        in your request body is correct before sending the request. If the
        configuration is incorrect, the updated Dataset Provider might not
        function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset Provider to update.
      requestBody:
        description: DatasetProvider object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatasetProvider"
            examples:
              DatasetProviderUpdateExamplesSwitchToManualKeys:
                $ref: "#/components/examples/DatasetProviderUpdateExamplesSwitchToManualKeys"
      responses:
        "200":
          description: The updated Dataset Provider
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetProvider"
              examples:
                DatasetProviderResponseExampleDefault:
                  $ref: "#/components/examples/DatasetProviderResponseExampleDefault"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.datasets.providers
    delete:
      operationId: deleteDatasetProviderById
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: delete
      tags:
        - datasets
      summary: Delete a Dataset Provider (Cribl.Cloud only)
      description: Delete the specified Dataset Provider (Cribl.Cloud only).
        Associated resources, such as Private Link connections, are cleaned up
        automatically where applicable.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset Provider to delete.
      responses:
        "200":
          description: The deleted Dataset Provider
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetProvider"
              examples:
                DatasetProviderResponseExampleDefault:
                  $ref: "#/components/examples/DatasetProviderResponseExampleDefault"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: search.datasets.providers
  /search/dataset-providers/{id}/acl:
    get:
      operationId: getDatasetProviderAclById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Get
      description: List accesses to DatasetProvider granted to users (Cribl.Cloud only).
      summary: Get DatasetProvider ACL (Cribl.Cloud only)
      tags: []
  /search/dataset-providers/{id}/acl/apply:
    post:
      operationId: createDatasetProviderAclApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclApplyDatasetProviderExamplesGrantAccess:
                $ref: "#/components/examples/AclApplyDatasetProviderExamplesGrantAccess"
              AclApplyDatasetProviderExamplesRevokeAccess:
                $ref: "#/components/examples/AclApplyDatasetProviderExamplesRevokeAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Create
      description: Add/remove accesses to DatasetProvider for users (Cribl.Cloud only).
      summary: Modify DatasetProvider ACL (Cribl.Cloud only)
      tags: []
  /search/dataset-providers/{id}/acl/teams:
    get:
      operationId: getDatasetProviderAclTeamsById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Get
      description: List accesses to DatasetProvider granted to Teams (Cribl.Cloud only).
      summary: Get DatasetProvider Teams (Cribl.Cloud only)
      tags: []
  /search/dataset-providers/{id}/acl/teams/apply:
    post:
      operationId: createDatasetProviderAclTeamsApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclTeamsApplyDatasetProviderExamplesGrantTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyDatasetProviderExamplesGrantTeamAcces\
                  s"
              AclTeamsApplyDatasetProviderExamplesRevokeTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyDatasetProviderExamplesRevokeTeamAcce\
                  ss"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Create
      description: Add/remove accesses to DatasetProvider for Teams (Cribl.Cloud only).
      summary: Modify DatasetProvider Teams ACL (Cribl.Cloud only)
      tags: []
  /search/dataset-providers/{id}/details:
    get:
      operationId: getDatasetProviderDetailsById
      tags:
        - datasets
      x-speakeasy-group: search.datasets.providers
      x-speakeasy-name-override: getProviderDetails
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get discovery data for a Dataset Provider (Cribl.Cloud only)
      description: Get discovery data for the specified Dataset Provider or an empty
        object when the Dataset Provider type has no additional details
        (Cribl.Cloud only).
      responses:
        "200":
          description: Provider-specific discovery fields
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetProviderDetails"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Dataset Provider not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset Provider.
  /search/datasets:
    get:
      operationId: listDataset
      x-speakeasy-group: search.datasets
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: list
      tags:
        - datasets
      summary: List all Datasets (Cribl.Cloud only)
      description: Get a list of all Datasets (Cribl.Cloud only).
      responses:
        "200":
          description: Datasets with fields implied by query parameters
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetEnriched"
              examples:
                DatasetResponseExampleCreatedS3Dataset:
                  $ref: "#/components/examples/DatasetResponseExampleCreatedS3Dataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of Datasets to return in the response for this
            request. Use with <code>offset</code> to paginate the response into
            manageable batches.
        - name: explorerStats
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include 30-day search counts and, for
            supported local Datasets, event and byte totals with minimum and
            maximum event timestamps.
        - name: lastUsed
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include the last-used timestamp from query
            history for each Dataset.
        - name: favorites
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include favorite records for each Dataset.
        - name: userId
          in: query
          required: false
          schema:
            type: string
          description: When <code>favorites</code> is <code>true</code>, restrict
            favorites to the specified user.
        - name: vtables
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include virtual table definitions as
            additional Dataset entries.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
    post:
      operationId: createDataset
      x-speakeasy-group: search.datasets
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: create
      tags:
        - datasets
      summary: Create a Dataset (Cribl.Cloud only)
      description: Create a new Dataset (Cribl.Cloud only).<br/><br/>The type is
        derived from the selected Dataset Provider configuration.
      requestBody:
        description: Dataset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Dataset"
            examples:
              DatasetCreateExamplesS3V2WithPaths:
                $ref: "#/components/examples/DatasetCreateExamplesS3V2WithPaths"
              DatasetCreateExamplesMinimalS3:
                $ref: "#/components/examples/DatasetCreateExamplesMinimalS3"
              DatasetCreateExamplesWithDescriptionAndTags:
                $ref: "#/components/examples/DatasetCreateExamplesWithDescriptionAndTags"
              DatasetCreateExamplesAzureBlobV1ContainerName:
                $ref: "#/components/examples/DatasetCreateExamplesAzureBlobV1ContainerName"
              DatasetCreateExamplesAzureBlobV2WithPaths:
                $ref: "#/components/examples/DatasetCreateExamplesAzureBlobV2WithPaths"
              DatasetCreateExamplesMinimalGcs:
                $ref: "#/components/examples/DatasetCreateExamplesMinimalGcs"
              DatasetCreateExamplesAmazonSecurityLake:
                $ref: "#/components/examples/DatasetCreateExamplesAmazonSecurityLake"
              DatasetCreateExamplesSnowflakeTable:
                $ref: "#/components/examples/DatasetCreateExamplesSnowflakeTable"
              DatasetCreateExamplesHttpApiEnabledEndpoints:
                $ref: "#/components/examples/DatasetCreateExamplesHttpApiEnabledEndpoints"
              DatasetCreateExamplesApiAzureResourceManager:
                $ref: "#/components/examples/DatasetCreateExamplesApiAzureResourceManager"
              DatasetCreateExamplesApiLogAnalyticsSecurityEvent:
                $ref: "#/components/examples/DatasetCreateExamplesApiLogAnalyticsSecurityEvent"
              DatasetCreateExamplesApiLogAnalyticsConstrainedKql:
                $ref: "#/components/examples/DatasetCreateExamplesApiLogAnalyticsConstrainedKql"
      responses:
        "200":
          description: The created Dataset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataset"
              examples:
                DatasetResponseExampleCreatedS3Dataset:
                  $ref: "#/components/examples/DatasetResponseExampleCreatedS3Dataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/datasets/{id}:
    get:
      operationId: getDatasetById
      x-speakeasy-group: search.datasets
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: get
      tags:
        - datasets
      summary: Get a Dataset (Cribl.Cloud only).
      description: Get the specified Dataset (Cribl.Cloud only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset to get.
      responses:
        "200":
          description: The requested Dataset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataset"
              examples:
                DatasetResponseExampleCreatedS3Dataset:
                  $ref: "#/components/examples/DatasetResponseExampleCreatedS3Dataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateDatasetById
      x-speakeasy-group: search.datasets
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: update
      tags:
        - datasets
      summary: Update a Dataset (Cribl.Cloud only)
      description: Update the specified Dataset (Cribl.Cloud only).<br/><br/>Provide a
        complete representation of the Dataset that you want to update in the
        request body. This endpoint does not support partial updates. Cribl
        removes any omitted fields when updating the Dataset.<br/><br/>Confirm
        that the configuration in your request body is correct before sending
        the request. If the configuration is incorrect, the updated Dataset
        might not function as expected.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset to update.
      requestBody:
        description: Dataset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Dataset"
            examples:
              DatasetUpdateExampleUpdateDescription:
                $ref: "#/components/examples/DatasetUpdateExampleUpdateDescription"
      responses:
        "200":
          description: The updated Dataset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataset"
              examples:
                DatasetResponseExampleCreatedS3Dataset:
                  $ref: "#/components/examples/DatasetResponseExampleCreatedS3Dataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteDatasetById
      x-speakeasy-group: search.datasets
      x-cribl-internal: false
      x-cribl-availability: cloud
      x-speakeasy-name-override: delete
      tags:
        - datasets
      summary: Delete a Dataset (Cribl.Cloud only)
      description: Delete the specified Dataset (Cribl.Cloud only).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset to delete.
      responses:
        "200":
          description: The deleted Dataset when a row was deleted.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDataset"
              examples:
                DatasetResponseExampleCreatedS3Dataset:
                  $ref: "#/components/examples/DatasetResponseExampleCreatedS3Dataset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/datasets/{id}/acl:
    get:
      operationId: getDatasetAclById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Get
      description: List accesses to Dataset granted to users (Cribl.Cloud only).
      summary: Get Dataset ACL (Cribl.Cloud only)
      tags:
        - datasets
  /search/datasets/{id}/acl/apply:
    post:
      operationId: createDatasetAclApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclApplyDatasetExamplesGrantAccess:
                $ref: "#/components/examples/AclApplyDatasetExamplesGrantAccess"
              AclApplyDatasetExamplesRevokeAccess:
                $ref: "#/components/examples/AclApplyDatasetExamplesRevokeAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Create
      description: Add/remove accesses to Dataset for users (Cribl.Cloud only).
      summary: Modify Dataset ACL (Cribl.Cloud only)
      tags:
        - datasets
  /search/datasets/{id}/acl/teams:
    get:
      operationId: getDatasetAclTeamsById
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Get
      description: List accesses to Dataset granted to Teams (Cribl.Cloud only).
      summary: Get Dataset Teams (Cribl.Cloud only)
      tags:
        - datasets
  /search/datasets/{id}/acl/teams/apply:
    post:
      operationId: createDatasetAclTeamsApplyById
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AclTeamsApplyDatasetExamplesGrantTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyDatasetExamplesGrantTeamAccess"
              AclTeamsApplyDatasetExamplesRevokeTeamAccess:
                $ref: "#/components/examples/AclTeamsApplyDatasetExamplesRevokeTeamAccess"
      responses:
        "200":
          description: Successful ACL modification.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items: {}
              examples:
                AclApplyResponseExamplesSuccess:
                  $ref: "#/components/examples/AclApplyResponseExamplesSuccess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-cribl-internal: true
      x-cribl-availability: cloud
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID for ACL Teams Create
      description: Add/remove accesses to Dataset for Teams (Cribl.Cloud only).
      summary: Modify Dataset Teams ACL (Cribl.Cloud only)
      tags:
        - datasets
  /search/federated_search/engines/{id}:
    get:
      operationId: getFederatedSearchEngineById
      tags:
        - search
      x-speakeasy-group: searches.federatedSearches.engines
      x-speakeasy-name-override: get
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Get a federated search engine (Cribl.Cloud only)
      description: Get the specified federated search engine (Cribl.Cloud only).
      responses:
        "200":
          description: The requested federated search engine
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedFederatedSearchEngine"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the engine.
    patch:
      operationId: updateFederatedSearchEngineById
      tags:
        - search
      x-speakeasy-group: searches.federatedSearches.engines
      x-speakeasy-name-override: update
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Update a federated search engine (Cribl.Cloud only)
      description: Update the specified federated search engine (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the federated
        search engine that you want to update in the request body. This endpoint
        does not support partial updates. Cribl removes any omitted fields when
        updating the federated search engine.<br/><br/>Confirm that the
        configuration in your request body is correct before sending the
        request. If the configuration is incorrect, the updated federated search
        engine might not function as expected.
      responses:
        "200":
          description: The updated federated search engine
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedFederatedSearchEngine"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: FederatedSearchEngine object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/FederatedSearchEngine"
            examples:
              FederatedSearchEngineUpdateExamplesTierOnly:
                $ref: "#/components/examples/FederatedSearchEngineUpdateExamplesTierOnly"
              FederatedSearchEngineUpdateExamplesUsageBased:
                $ref: "#/components/examples/FederatedSearchEngineUpdateExamplesUsageBased"
              FederatedSearchEngineUpdateExamplesWithDescription:
                $ref: "#/components/examples/FederatedSearchEngineUpdateExamplesWithDescription"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the engine to update.
  /search/federated_search/engines:
    get:
      operationId: getFederatedSearchEngine
      tags:
        - search
      x-speakeasy-group: searches.federatedSearches.engines
      x-speakeasy-name-override: list
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: List federated search engines (Cribl.Cloud only)
      description: Get a list of all federated search engines (Cribl.Cloud only).
      responses:
        "200":
          description: Federated engine configurations
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedFederatedSearchEngine"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of federated search engines to return in the
            response for this request. Use with <code>offset</code> to paginate
            the response into manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /search/local_search/engines:
    post:
      operationId: createLocalSearchEngine
      tags:
        - search
      x-speakeasy-group: searches.localSearches.engines
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Create a Local Search engine (Cribl.Cloud only)
      description: Creates a new Local Search engine (Cribl.Cloud only). Tier sizes
        reserved for operators must be created through the mansion endpoint
        instead.
      responses:
        "200":
          description: The created engine configuration
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchEngine"
              examples:
                LocalSearchEngineCountedResponseExamplesSingleEngine:
                  $ref: "#/components/examples/LocalSearchEngineCountedResponseExamplesSingleEngi\
                    ne"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LocalSearchEngine object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LocalSearchEngine"
            examples:
              LocalSearchEngineCreateExamplesMinimal:
                $ref: "#/components/examples/LocalSearchEngineCreateExamplesMinimal"
              LocalSearchEngineCreateExamplesMediumWithDescription:
                $ref: "#/components/examples/LocalSearchEngineCreateExamplesMediumWithDescripti\
                  on"
    get:
      operationId: getLocalSearchEngine
      tags:
        - search
      x-speakeasy-group: searches.localSearches.engines
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List Local Search engines (Cribl.Cloud only)
      description: Returns all configured Local Search engine instances, including
        lifecycle metadata and dataset attachments (Cribl.Cloud only).
      responses:
        "200":
          description: Paginated engine configurations for Local Search
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchEngine"
              examples:
                LocalSearchEngineCountedResponseExamplesSingleEngine:
                  $ref: "#/components/examples/LocalSearchEngineCountedResponseExamplesSingleEngi\
                    ne"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of Local Search engines to return in the response
            for this request. Use with <code>offset</code> to paginate the
            response into manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /search/local_search/engines/{id}:
    delete:
      operationId: deleteLocalSearchEngineById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.engines
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete a Local Search engine (Cribl.Cloud only)
      description: Marks the engine for termination (Cribl.Cloud only). When the
        engine owns the main dataset and other engines exist, supply
        <code>mainDatasetDestinationEngine</code> to reassign it first.
      responses:
        "200":
          description: The engine marked for deletion
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchEngine"
              examples:
                LocalSearchEngineCountedResponseExamplesSingleEngine:
                  $ref: "#/components/examples/LocalSearchEngineCountedResponseExamplesSingleEngi\
                    ne"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Local Search engine to delete.
        - name: mainDatasetDestinationEngine
          in: query
          required: false
          schema:
            type: string
          description: Target engine <code>id</code> that receives the main dataset when
            the deleted engine currently owns it.
    get:
      operationId: getLocalSearchEngineById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.engines
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get a Local Search engine (Cribl.Cloud only)
      description: Returns the specified Local Search engine with datasets and ingest
        metadata expanded when available (Cribl.Cloud only).
      responses:
        "200":
          description: The requested Local Search engine
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchEngine"
              examples:
                LocalSearchEngineCountedResponseExamplesSingleEngine:
                  $ref: "#/components/examples/LocalSearchEngineCountedResponseExamplesSingleEngi\
                    ne"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Local Search engine to get.
    patch:
      operationId: updateLocalSearchEngineById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.engines
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update a Local Search engine (Cribl.Cloud only)
      description: Updates an existing engine (Cribl.Cloud only). Resizes to operator
        tiers must use the mansion endpoint instead.
      responses:
        "200":
          description: The updated engine configuration
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchEngine"
              examples:
                LocalSearchEngineCountedResponseExamplesSingleEngine:
                  $ref: "#/components/examples/LocalSearchEngineCountedResponseExamplesSingleEngi\
                    ne"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LocalSearchEngine object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LocalSearchEngine"
            examples:
              LocalSearchEngineUpdateExamplesResize:
                $ref: "#/components/examples/LocalSearchEngineUpdateExamplesResize"
              LocalSearchEngineUpdateExamplesUpdateDescription:
                $ref: "#/components/examples/LocalSearchEngineUpdateExamplesUpdateDescription"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Local Search engine to update.
  /search/local_search/dataset-rulesets:
    post:
      operationId: createDatasetRule
      tags:
        - search
      x-speakeasy-group: searches.localSearches.datasetRulesets
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Create a lakehouse engine Dataset ruleset (Cribl.Cloud only)
      description: Create a new lakehouse engine Dataset ruleset (Cribl.Cloud only).
      responses:
        "200":
          description: The created lakehouse engine Dataset ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetRuleset"
              examples:
                LocalSearchDatasetRulesetCountedResponseExamplesSingleRuleset:
                  $ref: "#/components/examples/LocalSearchDatasetRulesetCountedResponseExamplesSi\
                    ngleRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DatasetRuleset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatasetRuleset"
            examples:
              LocalSearchDatasetRulesetCreateExamplesDefaultShape:
                $ref: "#/components/examples/LocalSearchDatasetRulesetCreateExamplesDefaultShap\
                  e"
              LocalSearchDatasetRulesetCreateExamplesMinimal:
                $ref: "#/components/examples/LocalSearchDatasetRulesetCreateExamplesMinimal"
              LocalSearchDatasetRulesetCreateExamplesWithExtendExpression:
                $ref: "#/components/examples/LocalSearchDatasetRulesetCreateExamplesWithExtendE\
                  xpression"
    get:
      operationId: getDatasetRule
      tags:
        - search
      x-speakeasy-group: searches.localSearches.datasetRulesets
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List lakehouse engine Dataset rulesets (Cribl.Cloud only)
      description: Get a list of all lakehouse engine Dataset rulesets (Cribl.Cloud only).
      responses:
        "200":
          description: Paginated lakehouse engine Dataset ruleset configurations
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetRuleset"
              examples:
                LocalSearchDatasetRulesetCountedResponseExamplesSingleRuleset:
                  $ref: "#/components/examples/LocalSearchDatasetRulesetCountedResponseExamplesSi\
                    ngleRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of Dataset rulesets to return in the response for
            this request. Use with <code>offset</code> to paginate the response
            into manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /search/local_search/dataset-rulesets/{id}:
    delete:
      operationId: deleteDatasetRuleById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.datasetRulesets
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete a lakehouse engine Dataset ruleset (Cribl.Cloud only)
      description: Delete the specified lakehouse engine Dataset ruleset (Cribl.Cloud only).
      responses:
        "200":
          description: Deleted Dataset ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetRuleset"
              examples:
                LocalSearchDatasetRulesetCountedResponseExamplesSingleRuleset:
                  $ref: "#/components/examples/LocalSearchDatasetRulesetCountedResponseExamplesSi\
                    ngleRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset ruleset to delete.
    get:
      operationId: getDatasetRuleById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.datasetRulesets
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get a lakehouse engine Dataset ruleset (Cribl.Cloud only)
      description: Get the specified lakehouse engine Dataset ruleset, including its
        ordered rule list (Cribl.Cloud only).
      responses:
        "200":
          description: The requested lakehouse engine Dataset ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetRuleset"
              examples:
                LocalSearchDatasetRulesetCountedResponseExamplesSingleRuleset:
                  $ref: "#/components/examples/LocalSearchDatasetRulesetCountedResponseExamplesSi\
                    ngleRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset ruleset to get.
    patch:
      operationId: updateDatasetRuleById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.datasetRulesets
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update a lakehouse engine Dataset ruleset (Cribl.Cloud only)
      description: Update the specified lakehouse engine Dataset ruleset (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the Dataset ruleset
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the Dataset ruleset.<br/><br/>Confirm that the configuration in your
        request body is correct before sending the request. If the configuration
        is incorrect, the updated Dataset ruleset might not function as
        expected.
      responses:
        "200":
          description: The updated lakehouse engine Dataset ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatasetRuleset"
              examples:
                LocalSearchDatasetRulesetCountedResponseExamplesSingleRuleset:
                  $ref: "#/components/examples/LocalSearchDatasetRulesetCountedResponseExamplesSi\
                    ngleRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DatasetRuleset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatasetRuleset"
            examples:
              LocalSearchDatasetRulesetUpdateExamplesAddRule:
                $ref: "#/components/examples/LocalSearchDatasetRulesetUpdateExamplesAddRule"
              LocalSearchDatasetRulesetUpdateExamplesMinimal:
                $ref: "#/components/examples/LocalSearchDatasetRulesetUpdateExamplesMinimal"
              LocalSearchDatasetRulesetUpdateExamplesWithExtendExpression:
                $ref: "#/components/examples/LocalSearchDatasetRulesetUpdateExamplesWithExtendE\
                  xpression"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset ruleset to update
  /search/local_search/datatype-rulesets:
    post:
      operationId: createDatatypeRule
      tags:
        - search
      x-speakeasy-group: searches.localSearches.datatypeRulesets
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Create a lakehouse engine Datatype ruleset (Cribl.Cloud only)
      description: Create a new lakehouse engine Datatype ruleset (Cribl.Cloud only).
      responses:
        "200":
          description: The created lakehouse engine Datatype ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatatypeRuleset"
              examples:
                LocalSearchDatatypeRulesetCountedResponseExamplesSingleRuleset:
                  $ref: "#/components/examples/LocalSearchDatatypeRulesetCountedResponseExamplesS\
                    ingleRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DatatypeRuleset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatatypeRuleset"
            examples:
              LocalSearchDatatypeRulesetCreateExamplesDefaultShape:
                $ref: "#/components/examples/LocalSearchDatatypeRulesetCreateExamplesDefaultSha\
                  pe"
              LocalSearchDatatypeRulesetCreateExamplesMinimal:
                $ref: "#/components/examples/LocalSearchDatatypeRulesetCreateExamplesMinimal"
              LocalSearchDatatypeRulesetCreateExamplesEmptyRules:
                $ref: "#/components/examples/LocalSearchDatatypeRulesetCreateExamplesEmptyRules"
    get:
      operationId: getDatatypeRule
      tags:
        - search
      x-speakeasy-group: searches.localSearches.datatypeRulesets
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List lakehouse engine Datatype rulesets (Cribl.Cloud only)
      description: Get a list of all lakehouse engine Datatype rulesets (Cribl.Cloud only).
      responses:
        "200":
          description: Paginated lakehouse engine Datatype ruleset configurations
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatatypeRuleset"
              examples:
                LocalSearchDatatypeRulesetCountedResponseExamplesSingleRuleset:
                  $ref: "#/components/examples/LocalSearchDatatypeRulesetCountedResponseExamplesS\
                    ingleRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of Datatype rulesets to return in the response for
            this request. Use with <code>offset</code> to paginate the response
            into manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /search/local_search/datatype-rulesets/{id}:
    delete:
      operationId: deleteDatatypeRuleById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.datatypeRulesets
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete a lakehouse engine Datatype ruleset (Cribl.Cloud only)
      description: Delete the specified lakehouse engine Datatype ruleset from
        configuration (Cribl.Cloud only).
      responses:
        "200":
          description: Deleted lakehouse engine Datatype ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatatypeRuleset"
              examples:
                LocalSearchDatatypeRulesetCountedResponseExamplesSingleRuleset:
                  $ref: "#/components/examples/LocalSearchDatatypeRulesetCountedResponseExamplesS\
                    ingleRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Datatype ruleset to delete.
    get:
      operationId: getDatatypeRuleById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.datatypeRulesets
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get a lakehouse engine Datatype ruleset (Cribl.Cloud only)
      description: Get the specified lakehouse engine Datatype ruleset, including its
        ordered rule list (Cribl.Cloud only).
      responses:
        "200":
          description: The requested lakehouse engine Datatype ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatatypeRuleset"
              examples:
                LocalSearchDatatypeRulesetCountedResponseExamplesSingleRuleset:
                  $ref: "#/components/examples/LocalSearchDatatypeRulesetCountedResponseExamplesS\
                    ingleRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Datatype ruleset to get.
    patch:
      operationId: updateDatatypeRuleById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.datatypeRulesets
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update a lakehouse engine Datatype ruleset (Cribl.Cloud only)
      description: Update the specified lakehouse engine Datatype ruleset (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the Datatype
        ruleset that you want to update in the request body. This endpoint does
        not support partial updates. Cribl removes any omitted fields when
        updating the Datatype ruleset.<br/><br/>Confirm that the configuration
        in your request body is correct before sending the request. If the
        configuration is incorrect, the updated Datatype ruleset might not
        function as expected.
      responses:
        "200":
          description: The updated Datatype ruleset
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDatatypeRuleset"
              examples:
                LocalSearchDatatypeRulesetCountedResponseExamplesSingleRuleset:
                  $ref: "#/components/examples/LocalSearchDatatypeRulesetCountedResponseExamplesS\
                    ingleRuleset"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DatatypeRuleset object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatatypeRuleset"
            examples:
              LocalSearchDatatypeRulesetUpdateExamplesAddRule:
                $ref: "#/components/examples/LocalSearchDatatypeRulesetUpdateExamplesAddRule"
              LocalSearchDatatypeRulesetUpdateExamplesMinimal:
                $ref: "#/components/examples/LocalSearchDatatypeRulesetUpdateExamplesMinimal"
              LocalSearchDatatypeRulesetUpdateExamplesWithDisabledRule:
                $ref: "#/components/examples/LocalSearchDatatypeRulesetUpdateExamplesWithDisabl\
                  edRule"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Datatype ruleset to update.
  /edge/appscope/processes:
    post:
      operationId: createEdgeAppscopeProcesses
      tags:
        - edgeAppScopeProcesses
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Attach AppScope to a Process
      description: Attach AppScope to a process running on the edge host.
      deprecated: true
      responses:
        "200":
          description: The created AppScopeProcess object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppScopeProcess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    get:
      operationId: getEdgeAppscopeProcesses
      tags:
        - edgeAppScopeProcesses
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all AppScope Processes
      description: Get a detailed list of scoped processes running on the edge host.
      deprecated: true
      responses:
        "200":
          description: List of AppScopeProcess objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppScopeProcess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /edge/appscope/processes/{pid}:
    delete:
      operationId: deleteEdgeAppscopeProcessesByPid
      tags:
        - edgeAppScopeProcesses
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Detach AppScope from a Process
      description: Detach AppScope from a process running on the edge host.
      deprecated: true
      responses:
        "200":
          description: The deleted AppScopeProcess object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppScopeProcess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: pid
          in: path
          required: true
          schema:
            type: string
          description: PID of the process
    get:
      operationId: getEdgeAppscopeProcessesByPid
      tags:
        - edgeAppScopeProcesses
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get an AppScope Process
      description: Get details of a scoped process running on the edge host.
      deprecated: true
      responses:
        "200":
          description: List of AppScopeProcess objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppScopeProcess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: pid
          in: path
          required: true
          schema:
            type: string
          description: PID of the process
    put:
      operationId: updateEdgeAppscopeProcessesByPid
      tags:
        - edgeAppScopeProcesses
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update an AppScope Process
      description: Update AppScope configuration for a process running on the edge host.
      deprecated: true
      responses:
        "200":
          description: The updated AppScopeProcess object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppScopeProcess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: pid
          in: path
          required: true
          schema:
            type: string
          description: PID of the process
  /edge/events/collectors:
    get:
      operationId: getEdgeEventsCollectors
      tags:
        - edgeEvents
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List all configured collectors
      description: Get list of configured collectors.
      responses:
        "200":
          description: List of EdgeSourceCollectorInfo objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEdgeSourceCollectorInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /edge/events/query:
    get:
      operationId: getEdgeEventsQuery
      tags:
        - edgeEvents
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Query edge events
      description: Get events generated by the specified Source.
      responses:
        "200":
          description: List of SourceEventsQueryResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSourceEventsQueryResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: files
          in: query
          required: false
          schema:
            type: string
          description: Event file to search for events, as well as rotation index, offset,
            and whether to read in reverse. Use the format
            <code><file_path>:<rotationIndex>:<offset>:<reverseRead></code> (for
            example, <code>hostsfile.log:0:0:true</code>).
        - name: source
          in: query
          required: true
          schema:
            type: string
          description: Type and subtype of the Source to search for events. Use the format
            <code>{type}/{subtype}</code> (for example,
            <code>system_state/hostsfile</code> or
            <code>system_state/routes</code>).
        - name: et
          in: query
          required: false
          schema:
            type: integer
          description: Epoch timestamp of the earliest event (includes rolled files
            present on disk)
        - name: lt
          in: query
          required: false
          schema:
            type: integer
          description: Epoch timestamp of the latest event (includes rolled files present
            on disk)
        - name: filter
          in: query
          required: false
          schema:
            type: string
          description: Filter
  /edge/fileinspect:
    get:
      operationId: getEdgeFileinspect
      tags:
        - edge
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get details about a file on the Edge host
      description: Get details about the specified file on the Edge host, including
        statistics about the file, a preview of its content, and its checksums.
      responses:
        "200":
          description: File details
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEdgeFileInspectResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: path
          in: query
          required: true
          schema:
            type: string
          description: Absolute path to the file to inspect
  /edge/ls{path}:
    get:
      operationId: getEdgeLsByPath
      tags:
        - edgeLs
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get a directory listing for a path.  If a limit parameter is provided,
        it will return a  a limited list of results.
      description: Get a directory listing for the specified path.
      responses:
        "200":
          description: List of FilesystemEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedFilesystemEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: path
          in: path
          required: true
          schema:
            type: string
          description: required The directory path to list (e.g., <code>/tmp</code> or
            <code>/var/log</code>). Empty path is not supported.
        - name: stats
          in: query
          required: false
          schema:
            type: boolean
          description: Set to <code>true</code> or <code>1</code> to include file
            statistics in the response.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: The maximum number of entries to return.
  /products/edge/map/query:
    post:
      operationId: createProductsEdgeMapQuery
      tags:
        - edge
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Query Edge map data
      description: Data for the Map View for Edge Fleets (Leader only).
      deprecated: true
      responses:
        "200":
          description: The created EdgeMapQueryResult object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEdgeMapQueryResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /edge/metadata:
    get:
      operationId: getEdgeMetadata
      tags:
        - edge
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get Edge host metadata
      description: Get the host's metadata structure.
      responses:
        "200":
          description: List of Metadata objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMetadata"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /edge/file/ingest:
    post:
      operationId: createEdgeFileIngest
      tags:
        - edge
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Ingest a file
      description: Ingest a specified file through a specified pipeline to a specified
        destination or send to routes.
      responses:
        "200":
          description: The created any object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedObject"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /edge/file/sample:
    get:
      operationId: getEdgeFileSample
      tags:
        - edge
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get a sample number of bytes from a file
      description: Get the specified sample number of bytes from the file at the
        specified path.
      responses:
        "200":
          description: List of SampleFile objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSampleFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: path
          in: query
          required: true
          schema:
            type: string
          description: Absolute path to the file to sample
        - name: bytesRequested
          in: query
          required: false
          schema:
            type: number
          description: Number of bytes to return from the sampled file, in bytes or
            kilobytes (KB), such as <code>100 KB</code>. Integers passed without
            units are interpreted as bytes. Default is <code>256 KB</code>.
            Maximum is the system limit (if configured) or 256 KB (if system
            limit is not configured).
  /edge/kube-logs:
    post:
      operationId: createEdgeKubeLogs
      tags:
        - kube-logs
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Request logs for a container from the Kubernetes API
      description: Request the logs for a Kubernetes container from the Kubernetes API
        logs endpoint.
      responses:
        "200":
          description: The created object object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedObject"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /edge/kube-proxy:
    get:
      operationId: getEdgeKubeProxy
      tags:
        - kube-proxy
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Proxy a Kubernetes API request
      description: Make a GET request to the K8s API.
      responses:
        "200":
          description: List of object objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedObject"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: path
          in: query
          required: true
          schema:
            type: string
          description: Kubernetes API resource path that you want to proxy.
  /edge/containers/{id}:
    get:
      operationId: getEdgeContainersById
      tags:
        - edgeContainers
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get the specified container
      description: Get details for a single container on the edge host. Add
        stream=true to get a stream instead.
      responses:
        "200":
          description: List of Container objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedContainer"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the container.
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/ContainerRuntimeType"
          description: Container type.
        - name: namespace
          in: query
          required: false
          schema:
            type: string
          description: For <code>containerd</code> containers, the namespace to search for
            the container. Defaults to the <code>default</code> namespace.
        - name: withStats
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>false</code>, omit extended metrics for the container.
            Extended metrics are included by default (<code>true</code>).
  /edge/containers:
    get:
      operationId: getEdgeContainers
      tags:
        - edgeContainers
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List all containers running on the Edge host
      description: Get a detailed list of the containers that are running on the Edge host.
      responses:
        "200":
          description: List of Container objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedContainer"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: limit
          in: query
          required: false
          schema:
            type: number
          description: Maximum number of containers to return in the response.
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/ContainerRuntimeType"
          description: Container type.
  /edge/logs:
    get:
      operationId: getEdgeLogs
      tags:
        - edge
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List Edge log files
      description: list log files.
      responses:
        "200":
          description: List of EdgeFile objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedEdgeFile"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: mode
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/EdgeLogDiscoveryMode"
          description: Discovery Mode (default is "auto")
        - name: allow
          in: query
          required: false
          schema:
            oneOf:
              - type: string
              - type: array
                items:
                  type: string
          description: List of allowed-filename wildcard patterns
        - name: path
          in: query
          required: false
          schema:
            type: string
          description: Search directory for "manual" mode
        - name: depth
          in: query
          required: false
          schema:
            type: number
          description: Search depth for "manual" mode
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Limits the number of entries returned.</br></br> When discovering
            files in auto mode, the actual count returned may be less than the
            limit due</br></br> to aggregation of files by pid.
  /edge/processes/{pid}:
    get:
      operationId: getEdgeProcessesByPid
      tags:
        - edgeProcesses
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get details for a process running on the Edge host
      description: Get details for the specified process that is running on the Edge
        host.<br><br> Get the <code>pid</code> for the process from the response
        to a <code>GET /edge/processes</code> request.
      responses:
        "200":
          description: List of Process objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProcess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: pid
          in: path
          required: true
          schema:
            type: string
          description: The <code>pid</code> of the process.
        - name: top
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, return extended metrics for the process.
  /edge/processes:
    get:
      operationId: getEdgeProcesses
      tags:
        - edgeProcesses
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List the processes running on the Edge host
      description: Get a detailed list of the processes that are running on the Edge
        host. Results are sorted by CPU usage in descending order (highest CPU
        first).
      responses:
        "200":
          description: List of Process objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProcess"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: limit
          in: query
          required: false
          schema:
            type: number
          description: Maximum number of processes to return in the response.
        - name: top
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, return extended metrics for all processes.
  /system/credentials/{id}:
    delete:
      operationId: deleteSystemCredentialsById
      tags:
        - credentials
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Delete an API Credential (Cribl.Cloud only)
      description: Delete the specified API Credential along with its access control
        list (Cribl.Cloud only).
      responses:
        "200":
          description: The deleted ApiCredential object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedApiCredential"
        "401":
          description: Unauthorized — invalid or expired JWT access token
        "404":
          description: API Credential not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the API Credential. Ends with
            <code>@clients</code>.
    get:
      operationId: getSystemCredentialsById
      tags:
        - credentials
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get an API Credential (Cribl.Cloud only)
      description: Get the specified API Credential (Cribl.Cloud only).
      responses:
        "200":
          description: List of ApiCredential objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedApiCredential"
        "401":
          description: Unauthorized — invalid or expired JWT access token
        "404":
          description: API Credential not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the API Credential. Ends with
            <code>@clients</code>.
    patch:
      operationId: updateSystemCredentialsById
      tags:
        - credentials
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Update an API Credential (Cribl.Cloud only)
      description: Update the specified API Credential (Cribl.Cloud
        only).<br/><br/>Provide a complete representation of the API Credential
        that you want to update in the request body. This endpoint does not
        support partial updates. Cribl removes any omitted fields when updating
        the API Credential.<br/><br/>Confirm that the configuration in your
        request body is correct before sending the request. If the configuration
        is incorrect, the updated API Credential might not function as expected.
      responses:
        "200":
          description: The updated ApiCredential object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedApiCredential"
        "400":
          description: Bad Request — invalid request body (for example, missing
            <code>roles</code>)
        "401":
          description: Unauthorized — invalid or expired JWT access token
        "404":
          description: API Credential not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ApiCredentialUpdate object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ApiCredentialUpdate"
            examples:
              ApiCredentialUpdateExamplesBasicUpdate:
                $ref: "#/components/examples/ApiCredentialUpdateExamplesBasicUpdate"
              ApiCredentialUpdateExamplesMultipleRoles:
                $ref: "#/components/examples/ApiCredentialUpdateExamplesMultipleRoles"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the API Credential. Ends with
            <code>@clients</code>.
  /system/credentials:
    get:
      operationId: getSystemCredentials
      tags:
        - credentials
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List all API Credentials (Cribl.Cloud only)
      description: Get a list of all API Credentials (Cribl.Cloud only).
      responses:
        "200":
          description: List of ApiCredential objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedApiCredential"
        "401":
          description: Unauthorized — invalid or expired Cloud token
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/credentials/{id}/acl:
    get:
      operationId: getSystemCredentialsAclById
      tags:
        - credentials
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get the access control list for an API Credential (Cribl.Cloud only)
      description: Get the access control list (ACL) for the specified API Credential
        (Cribl.Cloud only).
      responses:
        "200":
          description: List of ResourcePolicy objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedResourcePolicy"
        "401":
          description: Unauthorized — invalid or expired JWT access token
        "404":
          description: API Credential not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the API Credential. Ends with
            <code>@clients</code>.
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/RbacResource"
          description: The <code>type</code> of resource by which to filter access levels.
  /system/credentials/__cache__:
    delete:
      operationId: deleteSystemCredentialsCache
      tags:
        - credentials
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Clear API Credential cache (Cribl.Cloud only)
      description: Purge cached API Credentials (Cribl.Cloud only). Required when API
        Credentials are created, updated, or deleted in Cribl.Cloud.
      responses:
        "200":
          description: Cache purged successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedApiCredential"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /apps/{id}/acl/teams/apply:
    post:
      operationId: createAppsAclTeamsApplyById
      tags:
        - apps
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Apply team ACLs for an App
      description: Assign or remove team-level ACL policies for the specified App.
      responses:
        "200":
          description: ACLs applied successfully
        "400":
          description: Bad Request — invalid policy name or attempt to remove own
            permissions
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: App not found or App sharing is not enabled
        "405":
          description: Sharing is not supported for this resource type
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AppAclTeamsApplyExamplesGrantTeamAccess:
                $ref: "#/components/examples/AppAclTeamsApplyExamplesGrantTeamAccess"
              AppAclTeamsApplyExamplesRevokeTeamAccess:
                $ref: "#/components/examples/AppAclTeamsApplyExamplesRevokeTeamAccess"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the App.
  /apps/{id}/acl/apply:
    post:
      operationId: createAppsAclApplyById
      tags:
        - apps
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Apply user ACLs for an App
      description: Assign or remove user-level ACL policies for the specified App.
      responses:
        "200":
          description: ACLs applied successfully
        "400":
          description: Bad Request — invalid policy name or attempt to remove own
            permissions
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: App not found or App sharing is not enabled
        "405":
          description: Sharing is not supported for this resource type
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AccessControlSchema object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AccessControlSchema"
            examples:
              AppAclApplyExamplesGrantAccess:
                $ref: "#/components/examples/AppAclApplyExamplesGrantAccess"
              AppAclApplyExamplesRevokeAccess:
                $ref: "#/components/examples/AppAclApplyExamplesRevokeAccess"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the App.
  /apps:
    post:
      operationId: createApps
      tags:
        - apps
      x-speakeasy-group: apps
      x-speakeasy-name-override: install
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Install an App
      description: Install an App.<br><br> To install an uploaded App, provide the
        <code>source</code> value from the <code>PUT /apps</code> response as
        the <code>source</code> parameter in the request body.<br><br> To
        install an App by importing from a URL, provide the direct URL location
        of the <code>.crbl</code> file for the App as the <code>source</code>
        parameter in the request body.<br><br> To install an App by importing
        from a Git repository, provide <code>git+&lt;repo-url&gt;</code> as the
        <code>source</code> parameter in the request body.<br><br> If you do not
        include the <code>source</code> parameter in the request body, an empty
        App skeleton is created and installed.
      responses:
        "200":
          description: The created AppInstallInfo object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppInstallInfo"
        "400":
          description: Bad Request — invalid <code>id</code> (must not include a directory
            or path segment)
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: appRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AppRequestBody"
            examples:
              AppInstallExamplesHostedCrblUrl:
                $ref: "#/components/examples/AppInstallExamplesHostedCrblUrl"
              AppInstallExamplesEmptyAppSkeleton:
                $ref: "#/components/examples/AppInstallExamplesEmptyAppSkeleton"
              AppInstallExamplesUploadedFile:
                $ref: "#/components/examples/AppInstallExamplesUploadedFile"
              AppInstallExamplesURL:
                $ref: "#/components/examples/AppInstallExamplesURL"
              AppInstallExamplesGitRepository:
                $ref: "#/components/examples/AppInstallExamplesGitRepository"
    get:
      operationId: getApps
      tags:
        - apps
      x-speakeasy-group: apps
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Apps
      description: Get a list of all installed Apps.
      responses:
        "200":
          description: List of AppInfo objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    put:
      operationId: updateApps
      tags:
        - apps
      x-speakeasy-group: apps
      x-speakeasy-name-override: upload
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Upload an App file
      description: Upload an App file. Returns the <code>source</code> value needed to
        install the App with <code>POST /apps</code>.
      responses:
        "200":
          description: App file uploaded successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AppUploadResponse"
        "400":
          description: Bad Request — missing or invalid <code>filename</code> query
            parameter
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/octet-stream:
            schema:
              type: string
              format: binary
              description: App file upload
      parameters:
        - name: filename
          in: query
          required: true
          schema:
            type: string
          description: Filename of the App file to upload.
  /apps/{id}:
    delete:
      operationId: deleteAppsById
      tags:
        - apps
      x-speakeasy-group: apps
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Uninstall an App
      description: Uninstall the specified App.
      responses:
        "200":
          description: The deleted AppDeleteInfo object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppDeleteInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: App not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the App to uninstall.
    patch:
      operationId: updateAppsById
      tags:
        - apps
      x-speakeasy-group: apps
      x-speakeasy-name-override: upgrade
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Upgrade an App
      description: Upgrade the specified App from a new source.
      responses:
        "200":
          description: App upgraded successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppInstallInfo"
        "400":
          description: Bad Request — missing required <code>source</code> body parameter
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: App not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AppUpgradeRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AppUpgradeRequest"
            examples:
              AppUpgradeExamplesUpgradeFromURL:
                $ref: "#/components/examples/AppUpgradeExamplesUpgradeFromURL"
              AppUpgradeExamplesUpgradeFromUpload:
                $ref: "#/components/examples/AppUpgradeExamplesUpgradeFromUpload"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the App to upgrade.
  /apps/{id}/policies:
    get:
      operationId: getAppsPoliciesById
      tags:
        - apps
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get declared policies for an App
      description: Get the API policies declared in <code>policies.yml</code> for the
        specified App.
      responses:
        "200":
          description: List of declared policy entries for the App
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAuthPolicyEntry"
              examples:
                AppListPoliciesExamplesLookupPolicy:
                  $ref: "#/components/examples/AppListPoliciesExamplesLookupPolicy"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Access Denied
        "404":
          description: App not found or feature not enabled
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the App.
  /apps/{id}/proxies:
    get:
      operationId: getAppsProxiesById
      tags:
        - apps
      x-speakeasy-group: apps.proxies
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get proxy declarations for an App
      description: Get the proxy domain declarations from the <code>proxies.yml</code>
        for the specified App.
      responses:
        "200":
          description: List of proxy domain declarations for the App
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppProxyConfigEntity"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Access Denied
        "404":
          description: App not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the App.
  /apps/preinstall-check:
    post:
      operationId: createAppsPreinstallCheck
      tags:
        - apps
      x-speakeasy-group: apps
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Run a preinstall check for an App
      description: Check whether proxy declarations can be read from an App artifact
        before committing to a full install. Accepts the same
        <code>source</code> formats as <code>POST /apps</code> (staged upload
        filename, HTTPS URL, or <code>git+</code> URL).<br><br> No installation
        is performed. Works for both new installs and upgrades, allowing callers
        to inspect proxy declarations and dangerous file types before committing
        to either operation.<br><br> For <code>git+</code> sources, pass the
        same <code>spec</code> (branch, tag, or commit) you intend to use for
        the install or upgrade call to ensure the correct revision is checked
        out.<br><br> Returns the parsed contents of <code>proxies.yml</code>,
        the parsed contents of <code>policies.yml</code>, and a list of any
        files whose extensions match a blocklist of dangerous types (binaries,
        scripts, installers, etc.). The UI should surface
        <code>dangerousFileTypes</code> and <code>policies</code> to the user
        before allowing the install or upgrade to proceed so admins can review
        the policy rules an App ships with.
      responses:
        "200":
          description: Check succeeded; <code>proxies</code> is the parsed
            <code>proxies.yml</code> configuration, or <code>null</code> when
            the App declares no external proxy domains. <code>policies</code> is
            the list of policy entries declared in the App's
            <code>policies.yml</code>, or an empty array when the file is absent
            or empty (omitted entirely when App RBAC is disabled).
            <code>dangerousFileTypes</code> is a list of relative file paths
            with dangerous extensions, or an empty array when none are found.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAppPreinstallCheckResult"
        "400":
          description: Bad Request — missing or invalid <code>source</code>,
            <code>proxies.yml</code>/<code>policies.yml</code> exceeds size
            limits, or contains invalid YAML
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Not Found — staged file not found in the App staging area
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AppPreinstallCheckRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AppPreinstallCheckRequest"
            examples:
              AppPreinstallCheckExamplesStagedUpload:
                $ref: "#/components/examples/AppPreinstallCheckExamplesStagedUpload"
              AppPreinstallCheckExamplesHostedUrl:
                $ref: "#/components/examples/AppPreinstallCheckExamplesHostedUrl"
              AppPreinstallCheckExamplesGitRepository:
                $ref: "#/components/examples/AppPreinstallCheckExamplesGitRepository"
  /apps/{id}/acl/teams:
    get:
      operationId: getAppsAclTeamsById
      tags:
        - apps
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get team ACLs for an App
      description: Get the list of team access control entries for the specified App.
      responses:
        "200":
          description: List of TeamAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedTeamAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: App not found or App sharing is not enabled
        "405":
          description: Sharing is not supported for this resource type
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the App.
  /apps/{id}/acl:
    get:
      operationId: getAppsAclById
      tags:
        - apps
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get user ACLs for an App
      description: Get the list of user access control entries for the specified App.
      responses:
        "200":
          description: List of UserAccessControlList objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUserAccessControlList"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: App not found or App sharing is not enabled
        "405":
          description: Sharing is not supported for this resource type
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the App.
  /auth/authorization-code/callback:
    get:
      operationId: getAuthAuthorizationCodeCallback
      tags:
        - auth
      x-cribl-internal: true
      x-cribl-availability: both
      summary: API call that the IDP should use for an authorization code callback
      description: API call that the IDP should use for an authorization code callback.
      security: []
      responses:
        "200":
          description: Authorization success
          content:
            text/html:
              schema:
                type: string
        "401":
          description: Unauthorized
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: code
          in: query
          required: false
          schema:
            type: string
          description: Authorization Code
        - name: state
          in: query
          required: false
          schema:
            type: string
          description: State
  /auth/groups:
    get:
      operationId: getAuthGroups
      tags:
        - auth
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List authentication groups
      description: List the external authentication system's groups.
      security: []
      responses:
        "200":
          description: List of CrudEntityBase objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCrudEntityBase"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /auth/metadata:
    get:
      operationId: getAuthMetadata
      tags:
        - auth
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get service provider metadata
      description: Obtain metadata which Cribl Stream/Edge uses when acting as a
        Service Provider.
      security: []
      responses:
        "200":
          content:
            text/xml:
              schema:
                type: string
          description: Service Provider metadata
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /auth/multi-factor:
    get:
      operationId: getAuthMultiFactor
      tags:
        - auth
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get Personal Identity Verification (PIV) configuration
      description: Get PIV configuration.
      security: []
      responses:
        "200":
          description: List of MultiFactorAuthSchema objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMultiFactorAuthSchema"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /auth/users/{id}/token:
    delete:
      operationId: deleteAuthUsersTokenById
      tags:
        - auth
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Invalidate a user token
      description: Invalidate token(s) for user *id.
      responses:
        "200":
          description: The deleted SuccessResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSuccessResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: ID of user to invalidate
        - name: ttl
          in: query
          required: false
          schema:
            type: string
          description: TTL of the token being invalidated
  /auth/slo/callback:
    post:
      operationId: createAuthSloCallback
      tags:
        - auth
      x-cribl-internal: true
      x-cribl-availability: both
      summary: API call that the IDP should use for a logout request
      description: API call that the IDP should use for a logout request.
      security: []
      responses:
        "302":
          description: Redirects to home page on successful logout
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "429":
          description: Rate limit exceeded
          headers:
            retry-after:
              description: Number of seconds the client should wait before retrying the
                request
              schema:
                type: integer
                example: 60
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "501":
          description: IDP-initiated SLO is not supported
      requestBody:
        description: SamlCallbackBody object.
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/SamlCallbackBody"
    get:
      operationId: getAuthSloCallback
      tags:
        - auth
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Accepts a logout request from an IDP and logs out the user
      description: Accepts a logout request from an IDP and logs out the user.
      security: []
      responses:
        "302":
          description: Redirects to home page on successful logout
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "429":
          description: Rate limit exceeded
          headers:
            retry-after:
              description: Number of seconds the client should wait before retrying the
                request
              schema:
                type: integer
                example: 60
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "501":
          description: IDP-initiated SLO is not supported
      parameters:
        - name: SAMLResponse
          in: query
          required: false
          schema:
            type: string
          description: SAML Response
        - name: RelayState
          in: query
          required: false
          schema:
            type: string
          description: Relay State
  /auth/sso/callback:
    post:
      operationId: createAuthSsoCallback
      tags:
        - auth
      x-cribl-internal: true
      x-cribl-availability: both
      summary: API call that the IDP should use for an authentication request
      description: API call that the IDP should use for an authentication request.
      security: []
      responses:
        "200":
          content:
            text/html:
              schema:
                type: string
          description: Authentication success
        "400":
          description: Bad Request
        "401":
          description: Unauthorized
        "429":
          description: Rate limit exceeded
          headers:
            retry-after:
              description: Number of seconds the client should wait before retrying the
                request
              schema:
                type: integer
                example: 60
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SamlCallbackBody object.
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: "#/components/schemas/SamlCallbackBody"
    get:
      operationId: getAuthSsoCallback
      tags:
        - auth
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Accepts an authentication request from an IDP and authenticates the user
      description: Accepts an authentication request from an IDP and authenticates the user.
      security: []
      responses:
        "200":
          content:
            text/html:
              schema:
                type: string
          description: Authentication success
        "400":
          description: Bad Request
        "401":
          description: Unauthorized
        "429":
          description: Rate limit exceeded
          headers:
            retry-after:
              description: Number of seconds the client should wait before retrying the
                request
              schema:
                type: integer
                example: 60
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: SAMLResponse
          in: query
          required: false
          schema:
            type: string
          description: SAML Response
        - name: RelayState
          in: query
          required: false
          schema:
            type: string
          description: Relay State
  /auth/login:
    post:
      operationId: createAuthLogin
      tags:
        - auth
      x-speakeasy-group: auth.tokens
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Log in and fetch an authentication token
      description: This endpoint is unavailable on Cribl.Cloud. Instead, follow the
        instructions at https://docs.cribl.io/stream/api-tutorials/#criblcloud
        to get an Auth token for Cribl.Cloud.
      security: []
      responses:
        "200":
          description: Authentication token
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AuthToken"
        "401":
          description: Invalid credentials or authentication failed
        "429":
          description: Rate limit exceeded
          headers:
            retry-after:
              description: Number of seconds the client should wait before retrying the
                request
              schema:
                type: integer
                example: 60
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LoginInfo object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LoginInfo"
  /auth/logout:
    post:
      operationId: createAuthLogout
      tags:
        - auth
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Log out the current user
      description: Log out the current user.
      security: []
      responses:
        "200":
          description: Log out success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LogoutResponse"
        "401":
          description: Unauthorized
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /auth/users/{id}/invalidation:
    delete:
      operationId: deleteAuthUsersInvalidationById
      tags:
        - auth
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Remove token invalidation for a user
      description: Remove invalidation for user ID.
      responses:
        "200":
          description: The deleted SuccessResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSuccessResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: ID of user to reenable
  /auth/slo:
    get:
      operationId: getAuthSlo
      tags:
        - auth
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Redirect user to IDP with logout request
      description: Redirect user to IDP with logout request.
      security: []
      responses:
        "200":
          content:
            text/html:
              schema:
                type: string
          description: SLO Redirect info
        "400":
          description: Bad Request
        "401":
          description: Unauthorized
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /auth/sso:
    get:
      operationId: getAuthSso
      tags:
        - auth
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Obtain redirect information
      description: Obtain information needed to redirect users to the configured SSO
        IDP for authentication.
      security: []
      responses:
        "200":
          description: Redirect info
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SSORedirectInfoResponse"
        "401":
          description: Unauthorized
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /authorize/policy:
    get:
      operationId: getAuthorizePolicy
      tags:
        - authorize
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the authorization Policy
      description: get the client's authorization policy.
      responses:
        "200":
          description: List of AuthPolicyEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAuthPolicyEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /authorize/roles:
    get:
      operationId: getAuthorizeRoles
      tags:
        - authorize
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List authorization Roles
      description: get the client's roles.
      responses:
        "200":
          description: List of string objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/capture:
    post:
      operationId: createSystemCapture
      tags:
        - preview
      x-speakeasy-group: system.captures
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Capture live data
      description: Initiate a live data capture from Cribl Workers. Returns a stream
        of captured events in NDJSON format that match the parameters specified
        in the request body.
      responses:
        "200":
          description: Stream of captured events.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/CapturedEvent"
        "400":
          description: No worker nodes are connected to this worker group.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CaptureParamsReq object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CaptureParamsReq"
            examples:
              CaptureExamplesSimpleExpression:
                $ref: "#/components/examples/CaptureExamplesSimpleExpression"
              CaptureExamplesCompoundAndExpression:
                $ref: "#/components/examples/CaptureExamplesCompoundAndExpression"
              CaptureExamplesNestedFieldAccess:
                $ref: "#/components/examples/CaptureExamplesNestedFieldAccess"
              CaptureExamplesComplexFilter:
                $ref: "#/components/examples/CaptureExamplesComplexFilter"
  /system/projects/{projectId}/capture:
    post:
      operationId: createSystemProjectsCaptureByProjectId
      tags:
        - preview
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Capture live data at the Destination
      description: Capture live incoming data from a particular project and
        subscription at the destination.
      deprecated: true
      responses:
        "200":
          description: The created CapturedEvent object.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/CapturedEvent"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CaptureParamsReq object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CaptureParamsReq"
            examples:
              CaptureExamplesSimpleExpression:
                $ref: "#/components/examples/CaptureExamplesSimpleExpression"
              CaptureExamplesCompoundAndExpression:
                $ref: "#/components/examples/CaptureExamplesCompoundAndExpression"
              CaptureExamplesNestedFieldAccess:
                $ref: "#/components/examples/CaptureExamplesNestedFieldAccess"
              CaptureExamplesComplexFilter:
                $ref: "#/components/examples/CaptureExamplesComplexFilter"
      parameters:
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: Project ID
  /system/projects/{projectId}/subscriptions/{subId}/capture:
    post:
      operationId: createSystemProjectsSubscriptionsCaptureByProjectIdAndSubId
      tags:
        - preview
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Capture live data at a Subscription
      description: Capture live incoming data from a particular project and
        subscription at the subscription.
      deprecated: true
      responses:
        "200":
          description: The created CapturedEvent object.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/CapturedEvent"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CaptureParamsReq object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CaptureParamsReq"
            examples:
              CaptureExamplesSimpleExpression:
                $ref: "#/components/examples/CaptureExamplesSimpleExpression"
              CaptureExamplesCompoundAndExpression:
                $ref: "#/components/examples/CaptureExamplesCompoundAndExpression"
              CaptureExamplesNestedFieldAccess:
                $ref: "#/components/examples/CaptureExamplesNestedFieldAccess"
              CaptureExamplesComplexFilter:
                $ref: "#/components/examples/CaptureExamplesComplexFilter"
      parameters:
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: Project Id
        - name: subId
          in: path
          required: true
          schema:
            type: string
          description: Subscription Id
  /changelog/viewed:
    get:
      operationId: getChangelogViewed
      tags:
        - changelog
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get the viewed state for changelogs
      description: Get changelog viewed state.
      responses:
        "200":
          description: List of ChangelogState objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedChangelogState"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateChangelogViewed
      tags:
        - system
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Update the viewed state for changelogs
      description: Update changelog viewed state.
      responses:
        "200":
          description: The updated ChangelogState object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedChangelogState"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /output/click-house/describe-table:
    post:
      operationId: createOutputClickHouseDescribeTable
      tags:
        - click-house
      x-speakeasy-group: destinations.clickHouse
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Describe a ClickHouse table
      description: Describe the schema (column names and types) for the ClickHouse
        table identified in the request body.
      responses:
        "200":
          description: ClickHouse table description
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedClickHouseDescriptionResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ClickHouseDescriptionRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ClickHouseDescriptionRequest"
            examples:
              ClickHouseDescribeTableExamplesBasicAuth:
                $ref: "#/components/examples/ClickHouseDescribeTableExamplesBasicAuth"
              ClickHouseDescribeTableExamplesNoAuth:
                $ref: "#/components/examples/ClickHouseDescribeTableExamplesNoAuth"
  /clui:
    get:
      operationId: getClui
      tags:
        - clui
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Search the CLI
      description: Get CLUI search results.
      responses:
        "200":
          description: List of CluiItem objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCluiItem"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: query
          in: query
          required: true
          schema:
            type: string
          description: Search query
        - name: groupId
          in: query
          required: false
          schema:
            type: string
          description: The <code>id</code> of the Worker Group or Edge Fleet to get
            results from. Required in Distributed deployments. Omit in
            Single-instance deployments.
  /master/summary/workers:
    get:
      operationId: getSummaryWorkers
      tags:
        - workers
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a count of Worker and Edge Nodes
      description: Get a count of all Worker and Edge Nodes. Deprecated. Use
        /products/{product}/summary/workers instead.
      deprecated: true
      responses:
        "200":
          description: List of number objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNumber"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: filterExp
          in: query
          required: false
          schema:
            type: string
          description: Filter expression to evaluate against Nodes for inclusion in the
            response.
  /master/workers/{id}:
    get:
      operationId: getWorkersById
      tags:
        - workers
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a specific Worker or Edge Node for the specified Cribl product
      description: Get detailed metadata for a specific Worker or Edge Node for the
        specified Cribl product. Deprecated. Use
        /products/{product}/workers/{id} instead.
      deprecated: true
      responses:
        "200":
          description: List of MasterWorkerEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMasterWorkerEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The worker/node GUID.
  /master/workers:
    get:
      operationId: getWorkers
      tags:
        - workers
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get detailed metadata for Worker and Edge Nodes
      description: Get detailed metadata for Worker and Edge Nodes. Deprecated. Use
        /products/{product}/workers instead.
      deprecated: true
      responses:
        "200":
          description: List of MasterWorkerEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMasterWorkerEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: filterExp
          in: query
          required: false
          schema:
            type: string
          description: Filter expression to evaluate against Nodes for inclusion in the
            response.
        - name: sortExp
          in: query
          required: false
          schema:
            type: string
          description: Sorting expression to evaluate against Nodes to specify the sort
            order for the response.
        - name: filter
          in: query
          required: false
          schema:
            type: string
          description: JSON-stringified filter object to evaluate against Nodes for
            inclusion in the response.
        - name: sort
          in: query
          required: false
          schema:
            type: string
          description: JSON-stringified sorting object to evaluate against Nodes to
            specify the sort order for the response.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of Nodes to return in the response for this request.
            Use with <code>offset</code> to paginate the response into
            manageable batches.
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /master/workers/restart:
    patch:
      operationId: updateWorkersRestart
      tags:
        - workers
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Restart Worker and Edge Nodes
      description: Restarts Worker and Edge Nodes. Deprecated. Use
        /products/{product}/workers/restart instead.
      deprecated: true
      responses:
        "200":
          description: The updated RestartResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRestartResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /products/{product}/workers/rotate-token:
    post:
      operationId: createProductsWorkersRotateTokenByProduct
      tags:
        - workers
      x-speakeasy-group: nodes.rotateTokens
      x-speakeasy-name-override: bulkCreate
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Rotate the provisioning token on multiple Worker, Edge, or Outpost Nodes
      description: "Rotate the provisioning token on the specified Worker, Edge, or
        Outpost Nodes, replacing their current provisioning
        tokens.<br/><br/>Specify the target nodes either in the
        <code>guids</code> array or using
        <code>filter.group</code>.<br/><br/>Maximum 100 nodes per request. If
        the matched set exceeds 100, the response includes <code>truncated:
        true</code>  and <code>totalMatched</code>."
      responses:
        "200":
          description: The created RotateTokenResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRotateTokenResponse"
        "400":
          description: Bad Request if the product is not "stream", "edge", or "outpost",
            or if the request body is invalid.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden if the caller does not have permission to manage any of
            the requested groups.
        "404":
          description: Provisioning token ID not found.
        "409":
          description: Provisioning token is revoked, expired, or exhausted.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "501":
          description: Provisioning token store not initialized on this deployment.
      requestBody:
        description: RotateTokenBatchRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RotateTokenBatchRequest"
            examples:
              RotateTokenBatchExamplesRotateTokenByGuids:
                $ref: "#/components/examples/RotateTokenBatchExamplesRotateTokenByGuids"
              RotateTokenBatchExamplesRotateTokenByGroup:
                $ref: "#/components/examples/RotateTokenBatchExamplesRotateTokenByGroup"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product that contains the Nodes.
  /products/{product}/summary/workers:
    get:
      operationId: getProductsSummaryWorkersByProduct
      tags:
        - workers
      x-speakeasy-group: nodes
      x-speakeasy-name-override: count
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a count of Worker, Edge, or Outpost Nodes
      description: Get a count of all Worker, Edge, or Outpost Nodes for the specified
        Cribl product.
      responses:
        "200":
          description: List of number objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNumber"
        "400":
          description: Bad Request if the product is not "stream", "edge", or "outpost"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden to access product because you don't have permissions
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to get the count of Worker, Edge, or
            Outpost Nodes for.
        - name: filterExp
          in: query
          required: false
          schema:
            type: string
          description: Filter expression to evaluate against Nodes for inclusion in the
            response.
  /products/{product}/workers/{id}:
    get:
      operationId: getProductsWorkersByProductAndId
      tags:
        - workers
      x-speakeasy-group: nodes
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get detailed metadata for a Worker, Edge, or Outpost Node
      description: Get detailed metadata for the specified Worker, Edge, or Outpost
        Node for the specified Cribl product.
      responses:
        "200":
          description: List of MasterWorkerEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMasterWorkerEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden to access product because you don't have permissions
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product that contains the Node.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Node to get the metadata for.
  /products/{product}/workers:
    get:
      operationId: getProductsWorkersByProduct
      tags:
        - workers
      x-speakeasy-group: nodes
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get detailed metadata for Worker, Edge, or Outpost Nodes
      description: Get detailed metadata for Worker, Edge, or Outpost Nodes for the
        specified Cribl product.
      responses:
        "200":
          description: List of MasterWorkerEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMasterWorkerEntry"
        "400":
          description: Bad Request if the product is not "stream", "edge", or "outpost"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden to access product because you don't have permissions
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to get Worker, Edge, or Outpost Nodes for.
        - name: filterExp
          in: query
          required: false
          schema:
            type: string
          description: Filter expression to evaluate against Nodes for inclusion in the
            response.
        - name: sortExp
          in: query
          required: false
          schema:
            type: string
          description: Sorting expression to evaluate against Nodes to specify the sort
            order for the response.
        - name: filter
          in: query
          required: false
          schema:
            type: string
          description: JSON-stringified filter object to evaluate against Nodes for
            inclusion in the response.
        - name: sort
          in: query
          required: false
          schema:
            type: string
          description: JSON-stringified sorting object to evaluate against Nodes to
            specify the sort order for the response.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of Nodes to return in the response for this request.
            Use with <code>offset</code> to paginate the response into
            manageable batches.
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /products/{product}/workers/restart:
    patch:
      operationId: updateProductsWorkersRestartByProduct
      tags:
        - workers
      x-speakeasy-group: nodes
      x-speakeasy-name-override: restart
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Restart Worker, Edge, or Outpost Nodes
      description: Restart all Worker, Edge, or Outpost Nodes for the specified Cribl
        product.
      responses:
        "200":
          description: The updated RestartResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRestartResponse"
        "400":
          description: Bad Request if the product is not "stream", "edge", or "outpost"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden to access product because you don't have permissions
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: RestartRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RestartRequest"
            examples:
              RestartWorkersExamplesRestartWorkers:
                $ref: "#/components/examples/RestartWorkersExamplesRestartWorkers"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product whose Worker, Edge, or Outpost Nodes you
            want to restart.
  /products/{product}/workers/{id}/rotate-token:
    post:
      operationId: createProductsWorkersRotateTokenByProductAndId
      tags:
        - workers
      x-speakeasy-group: nodes.rotateTokens
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Rotate the provisioning token on a Worker, Edge, or Outpost Node
      description: Rotate the provisioning token on the specified Worker, Edge, or
        Outpost Node, replacing its current provisioning token.
      responses:
        "200":
          description: The created RotateTokenResult object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRotateTokenResult"
        "400":
          description: Bad Request if the product is not "stream", "edge", or "outpost",
            or if the request body is invalid.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden if the caller does not have permission to manage the
            worker's group.
        "404":
          description: Worker GUID or provisioning token ID not found.
        "409":
          description: Provisioning token is revoked, expired, or exhausted.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "501":
          description: Provisioning token store not initialized on this deployment.
      requestBody:
        description: RotateTokenRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RotateTokenRequest"
            examples:
              RotateTokenExamplesRotateToken:
                $ref: "#/components/examples/RotateTokenExamplesRotateToken"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product that contains the Node.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker, Edge, or Outpost Node to rotate
            the token on.
  /master/outposts:
    get:
      operationId: listMasterWorkerEntry
      deprecated: true
      x-speakeasy-group: outposts.nodes
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - outpost
      summary: Retrieve detailed metadata for Outpost Nodes
      description: Retrieve detailed metadata for Outpost Nodes. Deprecated. Use
        <code>GET /products/outpost/workers</code> instead.
      responses:
        "200":
          description: List of MasterWorkerEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMasterWorkerEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: filter
          in: query
          required: false
          schema:
            type: string
          description: Filter object (JSON stringified) to select nodes
        - name: sort
          in: query
          required: false
          schema:
            type: string
          description: Sorting object (JSON stringified) expression evaluated against nodes
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of nodes to return
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Pagination offset
        - name: filterExp
          in: query
          required: false
          schema:
            type: string
          description: Filter expression evaluated against nodes (deprecated, use filter
            instead)
        - name: sortExp
          in: query
          required: false
          schema:
            type: string
          description: Sorting expression evaluated against nodes (deprecated, use sort
            instead)
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
    post:
      operationId: createMasterWorkerEntry
      deprecated: true
      x-speakeasy-group: outposts.nodes
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: create
      tags:
        - outpost
      summary: Create MasterWorkerEntry
      description: Create MasterWorkerEntry.
      requestBody:
        description: New MasterWorkerEntry object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MasterWorkerEntry"
      responses:
        "200":
          description: The created MasterWorkerEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMasterWorkerEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /master/outposts/{id}:
    get:
      operationId: getMasterWorkerEntryById
      deprecated: true
      x-speakeasy-group: outposts.nodes
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - outpost
      summary: Retrieve detailed metadata for a specific Outpost Node
      description: Retrieve detailed metadata for the specified Outpost Node.
        Deprecated. Use <code>GET /products/outpost/workers/{id}</code> instead.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The outpost node GUID.
      responses:
        "200":
          description: List of MasterWorkerEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMasterWorkerEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateMasterWorkerEntryById
      deprecated: true
      x-speakeasy-group: outposts.nodes
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - outpost
      summary: Update MasterWorkerEntry
      description: Update MasterWorkerEntry.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to PATCH
      requestBody:
        description: MasterWorkerEntry object to be updated.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MasterWorkerEntry"
      responses:
        "200":
          description: The updated MasterWorkerEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMasterWorkerEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteMasterWorkerEntryById
      deprecated: true
      x-speakeasy-group: outposts.nodes
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - outpost
      summary: Delete MasterWorkerEntry
      description: Delete MasterWorkerEntry.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted MasterWorkerEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMasterWorkerEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /master/outposts/restart:
    patch:
      operationId: updateMasterWorkerEntry
      tags:
        - outpost
      x-speakeasy-group: outposts.nodes
      x-speakeasy-name-override: restart
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Restart Outpost Nodes
      description: Restart Outpost Nodes. Deprecated. Use <code>PATCH
        /products/outpost/workers/restart</code> instead.
      deprecated: true
      responses:
        "200":
          description: The updated RestartResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedRestartResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /master/outposts/upgrade:
    patch:
      operationId: updateOutpostsUpgrade
      tags:
        - outpost
      x-speakeasy-group: outposts.nodes
      x-speakeasy-name-override: upgrade
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Upgrade Outpost Nodes
      description: upgrades outpost nodes.
      deprecated: true
      responses:
        "200":
          description: The updated OutpostUpgradeResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOutpostUpgradeResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /master/bundles/{group}/{version}:
    get:
      operationId: getBundlesByGroupAndVersion
      tags:
        - distributed
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Download config bundle (used by remote nodes)
      description: Download config bundle (used by remote nodes).
      responses:
        "200":
          content:
            application/tar+gzip:
              schema:
                type: string
                format: binary
          description: A Get contents of a config bundle
        "400":
          description: Invalid path
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: File is missing
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: group
          in: path
          required: true
          schema:
            type: string
          description: Group name
        - name: version
          in: path
          required: true
          schema:
            type: string
          description: Version number
  /master/bundles/{group}/lookups/{context}/{file}:
    get:
      operationId: getBundlesLookupsByGroupAndContextAndFile
      tags:
        - distributed
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Download lookup bundle (used by remote nodes)
      description: Download lookup bundle (used by remote nodes).
      responses:
        "200":
          content:
            application/tar+gzip:
              schema:
                type: string
                format: binary
          description: Get contents of a lookup bundle
        "400":
          description: Invalid path
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: File is missing
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: group
          in: path
          required: true
          schema:
            type: string
          description: Group name
        - name: context
          in: path
          required: true
          schema:
            type: string
          description: Context name
        - name: file
          in: path
          required: true
          schema:
            type: string
          description: File name
  /master/summary:
    get:
      operationId: getSummary
      tags:
        - distributed
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a summary of the Distributed deployment
      description: Get a summary of the Distributed deployment. The response includes
        counts of Worker Groups, Edge Fleets, Pipelines, Routes, Sources,
        Destinations, and Worker and Edge Nodes, as well as statistics for the
        Worker and Edge Nodes. Deprecated. Use /api/v1/products/:product/summary
        instead.
      deprecated: true
      responses:
        "200":
          description: List of DistributedSummary objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDistributedSummary"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: mode
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/WorkerTypes"
          description: "Filter for limiting the response by Cribl product: Cribl Stream
            (<code>worker</code>) or Cribl Edge (<code>managed-edge</code>)."
  /products/{product}/groups/{group}/summary:
    get:
      operationId: getProductsGroupsSummaryByProductAndGroup
      tags:
        - distributed
      x-speakeasy-group: nodes.groups.summaries
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a summary of the Distributed deployment for a specific Worker
        Group, Edge Fleet, or Outpost Group
      description: Get a summary of the Distributed deployment for a specific Worker
        Group, Edge Fleet, or Outpost Group. The response includes count of
        Pipelines, Routes, Sources, Destinations, and Worker, Edge, or Outpost
        Nodes, as well as statistics for those Nodes.
      responses:
        "200":
          description: List of DistributedSummary objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDistributedSummary"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsCore"
          description: Name of the Cribl product to get the Worker Group, Edge Fleet, or
            Outpost Group summary for.
        - name: group
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group, Edge Fleet, or Outpost
            Group to get the summary for.
  /products/{product}/summary:
    get:
      operationId: getProductsSummaryByProduct
      tags:
        - distributed
      x-speakeasy-group: nodes.summaries
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a summary of the deployment for a specific product.
      description: Get a summary of the deployment for the specified Cribl product
        (Stream or Edge).<br/><br/>The summary includes a count of Worker Groups
        or Edge Fleets and resources  such as Pipelines, Routes, Sources, and
        Destinations. For Distributed deployments,  it also includes a count and
        statistics for Worker or Edge Nodes.
      responses:
        "200":
          description: List of DistributedSummary objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDistributedSummary"
        "400":
          description: Bad Request if the product is not "stream" or "edge"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden to access product because you don't have permissions
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsBase"
          description: Name of the Cribl product to get the summary for.
  /system/distributed/upgrade/cancel/{group}:
    post:
      operationId: createSystemDistributedUpgradeCancelByGroup
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Cancel upgrade for a Worker Group
      description: Cancel a running upgrade for the specified Worker Group.
      responses:
        "200":
          description: The created UpgradeWorkerInfo object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUpgradeWorkerInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: group
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group whose upgrade you want to
            cancel.
  /system/distributed/upgrade/stage/{group}:
    post:
      operationId: createSystemDistributedUpgradeStageByGroup
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Stage upgrade for a Worker Group
      description: Stage the upgrade process for the specified Worker Group.
      responses:
        "200":
          description: The created UpgradeWorkerInfo object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUpgradeWorkerInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: distributedUpgrade object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DistributedUpgradeRequest"
            examples:
              DistributedUpgradeExamplesRollingUpgrade:
                $ref: "#/components/examples/DistributedUpgradeExamplesRollingUpgrade"
      parameters:
        - name: group
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group to upgrade.
  /system/distributed/upgrade/{group}:
    post:
      operationId: createSystemDistributedUpgradeByGroup
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Execute a Worker Group upgrade
      description: Execute an upgrade for the specified Worker Group in a distributed
        deployment.
      responses:
        "200":
          description: The created string object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: distributedUpgrade object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DistributedUpgradeRequest"
            examples:
              DistributedUpgradeExamplesRollingUpgrade:
                $ref: "#/components/examples/DistributedUpgradeExamplesRollingUpgrade"
      parameters:
        - name: group
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Worker Group to upgrade.
  /system/distributed/upgrade/download/{file}:
    get:
      operationId: getSystemDistributedUpgradeDownloadByFile
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get an upgrade package
      description: Get the specified upgrade package file from the distributed
        download directory on the Leader. Returns the file as a download.
      responses:
        "200":
          content:
            application/tar+gzip:
              schema:
                type: string
                format: binary
          description: The upgrade package file
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: file
          in: path
          required: true
          schema:
            type: string
          description: Exact name of the upgrade package file.
  /lib/expression:
    post:
      operationId: createLibExpression
      tags:
        - expressions
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Evaluate JavaScript expressions
      description: Evaluate one or more JavaScript expressions and return their
        evaluated results.
      responses:
        "200":
          description: The created ExprLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedExprLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /p/{pack}/lib/expression:
    post:
      operationId: createLibExpressionByPack
      tags:
        - expressions
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Evaluate JavaScript expressions within a Pack
      description: Evaluate one or more JavaScript expressions and return their
        evaluated results within the specified Pack.
      responses:
        "200":
          description: The created ExprLibEntry object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedExprLibEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      x-speakeasy-group: packs.expressions
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /conditions:
    get:
      operationId: listCondition
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - conditions
      summary: Get a list of Condition objects
      description: Get a list of Condition objects.
      responses:
        "200":
          description: List of Condition objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCondition"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /conditions/{id}:
    get:
      operationId: getConditionById
      x-cribl-internal: false
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - conditions
      summary: Get Condition by ID
      description: Get Condition by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of Condition objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCondition"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /health:
    get:
      operationId: getHealth
      tags:
        - health
      x-speakeasy-group: health
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the health status of the server
      description: Get the current health status of the server (Leader or Worker
        Node). In Distributed deployments, requests routed to a Worker or Edge
        node using the [host
        context](https://docs.cribl.io/cribl-as-code/api#base-url-group-fleet-host)
        require a Bearer token for
        [authentication](https://docs.cribl.io/cribl-as-code/api-auth/).
      security:
        - {}
        - bearerAuth: []
        - clientOauth: []
      responses:
        "200":
          description: Healthy status
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/HealthServerStatus"
              examples:
                HealthExamplesHealthyPrimary:
                  $ref: "#/components/examples/HealthExamplesHealthyPrimary"
        "420":
          description: Server is shutting down or in standby mode
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/HealthServerStatus"
              examples:
                Health420ExamplesShuttingDown:
                  $ref: "#/components/examples/Health420ExamplesShuttingDown"
                Health420ExamplesStandby:
                  $ref: "#/components/examples/Health420ExamplesStandby"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /health/workers:
    get:
      operationId: getHealthWorkers
      tags:
        - health
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the health status of Worker Processes
      description: Get the current health status of Worker Processes that the server
        manages.
      security: []
      responses:
        "200":
          description: Healthy status
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/HealthyWorkerStatus"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "420":
          description: Down status
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DownWorkerStatus"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /insights/metrics/query:
    post:
      operationId: createInsightsMetricsQuery
      tags:
        - insights
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Query metric values (Cribl.Cloud only)
      description: Retrieve the latest metric values, optionally aggregated, for
        multiple time series (Cribl.Cloud only).
      responses:
        "200":
          description: The created InsightsQueryResponse object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/InsightsQueryResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: InsightsQueryRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/InsightsQueryRequest"
  /jobs/{id}/cancel:
    patch:
      operationId: updateJobsCancelById
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Cancel a job
      description: Cancel a job by instance id.
      responses:
        "200":
          description: The updated JobState object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedJobState"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Job instance id
  /jobs:
    post:
      operationId: createJobs
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a job
      description: Create and run or schedule a new job.
      responses:
        "200":
          description: The created string object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SavedJob object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SavedJob"
    get:
      operationId: getJobs
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all jobs
      description: Get a list of all jobs.
      responses:
        "200":
          description: List of JobInfoResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedJobInfoResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Pagination offset
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of items to return
        - name: runType
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/JobRunTypes"
          description: Filter by job run type
        - name: state
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/StateType"
          description: Filter by current job state.
        - name: id
          in: query
          required: false
          schema:
            type: string
          description: Filter by job id, e.g. "id=1608713335.3&id=1608713326.1"
        - name: collectorId
          in: query
          required: false
          schema:
            type: string
          description: Filter by collector id, e.g. "collectorId=Prometheus-in"
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /jobs/{id}:
    delete:
      operationId: deleteJobsById
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete a job
      description: Remove job from job inspector by instance id.
      responses:
        "200":
          description: The deleted JobInfoResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedJobInfoResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Job instance id
    get:
      operationId: getJobsById
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a job
      description: Get job info by instance id.
      responses:
        "200":
          description: List of JobInfoResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedJobInfoResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Job instance id
  /jobs/{id}/keep:
    patch:
      operationId: updateJobsKeepById
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Keep a job
      description: prevent job from being deleted automatically.
      responses:
        "200":
          description: The updated JobInfoResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedJobInfoResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Job Instance id
  /jobs/{id}/pause:
    patch:
      operationId: updateJobsPauseById
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Pause a job
      description: Pause a job by instance id.
      responses:
        "200":
          description: The updated JobState object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedJobState"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Job instance id
  /jobs/{id}/resume:
    patch:
      operationId: updateJobsResumeById
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Resume a job
      description: Resume a job by instance id.
      responses:
        "200":
          description: The updated JobState object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedJobState"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Job instance id
  /jobs/{id}/diagnostics/{group}:
    get:
      operationId: getJobsDiagnosticsByIdAndGroup
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get diagnostic events for a job by Worker Group or Edge Fleet
      description: Get diagnostic events for a job by instance id.
      responses:
        "200":
          description: The requested DiagnosticStreamLine object.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/DiagnosticStreamLine"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Instance id of the job to get diagnostics for
        - name: group
          in: path
          required: true
          schema:
            type: string
          description: Group the job belongs to
  /jobs/{id}/results/{group}:
    get:
      operationId: getJobsResultsByIdAndGroup
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get results for a job
      description: Get results for a discover job by instance id.
      responses:
        "200":
          description: The requested ResultsStreamLine object.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/ResultsStreamLine"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Instance id of the job to get results for
        - name: group
          in: path
          required: true
          schema:
            type: string
          description: Group the job belongs to
        - name: maxFiles
          in: query
          required: false
          schema:
            type: integer
          description: Maximum files to get job results
  /jobs/{id}/errors/{group}:
    get:
      operationId: getJobsErrorsByIdAndGroup
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get task errors for a job by Worker Group or Edge Fleet
      description: Get Task errors for a job by id.
      responses:
        "200":
          description: The requested TaskError object.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/TaskError"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Job or task errors not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Instance id of the job to get results for
        - name: group
          in: path
          required: true
          schema:
            type: string
          description: Group the job belongs to
  /jobs/{id}/results:
    get:
      operationId: getJobsResultsById
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get Job Results
      description: Get results for a discover job by instance id.
      responses:
        "200":
          content:
            application/x-ndjson:
              schema:
                type: string
                format: binary
          description: Get results for a discover job by instance id
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Job instance id
  /jobs/{id}/errors:
    get:
      operationId: getJobsErrorsById
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get task errors for a job
      description: Get Task errors for a job by id.
      responses:
        "200":
          description: The requested TaskError object.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/TaskError"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Instance id of the job to get results for
  /jobs/{id}/diagnostics:
    get:
      operationId: getJobsDiagnosticsById
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get diagnostic events for a job
      description: Get diagnostic events for a job by instance id.
      responses:
        "200":
          description: The requested DiagnosticStreamLine object.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/DiagnosticStreamLine"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Job instance id
  /p/{pack}/jobs:
    post:
      operationId: createJobsByPack
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a job within a Pack
      description: Create and run or schedule a new job within the specified Pack.
      responses:
        "200":
          description: The created string object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SavedJob object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SavedJob"
      x-speakeasy-group: packs.jobs
      parameters:
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
    get:
      operationId: getJobsByPack
      tags:
        - jobs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all jobs within a Pack
      description: Get a list of all jobs within the specified Pack.
      responses:
        "200":
          description: List of JobInfoResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PaginatedJobInfoResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Pagination offset
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of items to return
        - name: runType
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/JobRunTypes"
          description: Filter by job run type
        - name: state
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/StateType"
          description: Filter by current job state.
        - name: id
          in: query
          required: false
          schema:
            type: string
          description: Filter by job id, e.g. "id=1608713335.3&id=1608713326.1"
        - name: collectorId
          in: query
          required: false
          schema:
            type: string
          description: Filter by collector id, e.g. "collectorId=Prometheus-in"
        - name: pack
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
      x-speakeasy-group: packs.jobs
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /security/kms/config:
    get:
      operationId: getSecurityKmsConfig
      tags:
        - security
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the KMS configuration
      description: Get Cribl KMS config.
      responses:
        "200":
          description: List of KMSProviderConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedKmsProviderConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSecurityKmsConfig
      tags:
        - security
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update the KMS configuration
      description: Update Cribl KMS config.
      responses:
        "200":
          description: The updated KMSProviderConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedKmsProviderConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: KMSProviderConfig object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/KMSProviderConfig"
  /security/kms/health:
    get:
      operationId: getSecurityKmsHealth
      tags:
        - security
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get KMS health
      description: Get Cribl KMS health.
      responses:
        "200":
          description: List of KMSHealth objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedKmsHealth"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/licenses:
    post:
      operationId: createSystemLicenses
      tags:
        - licenses
      x-cribl-internal: false
      x-cribl-availability: onprem
      summary: Add a license (on-prem only)
      description: Add a license to your Cribl deployment (on-prem only).
      responses:
        "200":
          description: The created License object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLicense"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LicenseRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LicenseRequest"
            examples:
              CreateLicenseExamplesAddLicense:
                $ref: "#/components/examples/CreateLicenseExamplesAddLicense"
    get:
      operationId: getSystemLicenses
      tags:
        - licenses
      x-cribl-internal: false
      x-cribl-availability: onprem
      summary: List all Licenses (on-prem only)
      description: Get a list of all License objects (on-prem only).
      responses:
        "200":
          description: List of License objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLicense"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/licenses/{id}:
    delete:
      operationId: deleteSystemLicensesById
      tags:
        - licenses
      x-cribl-internal: false
      x-cribl-availability: onprem
      summary: Delete a License (on-prem only)
      description: Delete the specified License (on-prem only).
      responses:
        "200":
          description: The deleted License object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLicense"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the License to delete.
    get:
      operationId: getSystemLicensesById
      tags:
        - licenses
      x-cribl-internal: false
      x-cribl-availability: onprem
      summary: Get a License (on-prem only)
      description: Get the specified License (on-prem only).
      responses:
        "200":
          description: List of License objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLicense"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the License to get.
  /system/licenses/usage:
    get:
      operationId: getSystemLicensesUsage
      tags:
        - licenses
      x-cribl-internal: false
      x-cribl-availability: onprem
      summary: Get license usage (on-prem only)
      description: Get license usage metrics, aggregated by day, up to last 90 days
        (on-prem only).
      responses:
        "200":
          description: List of UsageMetricsExtended objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUsageMetricsExtended"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/logger:
    get:
      operationId: listLoggerConfig
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: list
      tags:
        - logger
      summary: Get a list of LoggerConfig objects
      description: Get a list of LoggerConfig objects.
      responses:
        "200":
          description: List of LoggerConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLoggerConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/logger/{id}:
    get:
      operationId: getLoggerConfigById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: get
      tags:
        - logger
      summary: Get LoggerConfig by ID
      description: Get LoggerConfig by ID.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to GET.
      responses:
        "200":
          description: List of LoggerConfig objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLoggerConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateLoggerConfigById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: update
      tags:
        - logger
      summary: Update LoggerConfig
      description: Update LoggerConfig.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to PATCH
      requestBody:
        description: LoggerConfig object to be updated.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LoggerConfig"
      responses:
        "200":
          description: The updated LoggerConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLoggerConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteLoggerConfigById
      x-cribl-internal: true
      x-cribl-availability: both
      x-speakeasy-name-override: delete
      tags:
        - logger
      summary: Delete LoggerConfig
      description: Delete LoggerConfig.
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Unique ID to DELETE.
      responses:
        "200":
          description: The deleted LoggerConfig object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLoggerConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/jobs/logs/{id}/{groupId}:
    get:
      operationId: getSystemJobsLogsByIdAndGroupId
      tags:
        - logging
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get job log output
      description: Get contents of the log file.
      responses:
        "200":
          description: List of LogSearchResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLogSearchResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Job id
        - name: groupId
          in: path
          required: true
          schema:
            type: string
          description: Group ID
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of log lines to retrieve starting from offset.
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Offset in the current log file to fetch the log events from.
        - name: endOffset
          in: query
          required: false
          schema:
            type: integer
          description: in the current log file to fetch the log events upto.
        - name: et
          in: query
          required: false
          schema:
            type: integer
          description: Epoch timestamp of the earliest event (includes rolled files
            present on disk)
        - name: lt
          in: query
          required: false
          schema:
            type: integer
          description: Epoch timestamp of the latest event (includes rolled files present
            on disk)
        - name: filter
          in: query
          required: false
          schema:
            type: string
          description: Filter
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /system/logs/{id}:
    get:
      operationId: getSystemLogsById
      tags:
        - logging
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get a log file
      description: Get contents of the log file.
      responses:
        "200":
          description: List of LogFetcherResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLogFetcherResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: Log ID
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of log lines to retrieve starting from offset.
        - name: endOffset
          in: query
          required: false
          schema:
            type: integer
          description: in the current log file to fetch the log events upto.
        - name: et
          in: query
          required: false
          schema:
            type: integer
          description: Epoch timestamp of the earliest event (includes rolled files
            present on disk)
        - name: lt
          in: query
          required: false
          schema:
            type: integer
          description: Epoch timestamp of the latest event (includes rolled files present
            on disk)
        - name: filter
          in: query
          required: false
          schema:
            type: string
          description: Filter
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: endOffset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /system/logs:
    get:
      operationId: getSystemLogs
      tags:
        - logging
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List all log files
      description: Get a list of log files.
      responses:
        "200":
          description: List of LogFileInfo objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLogFileInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/logs/search:
    get:
      operationId: getSystemLogsSearch
      tags:
        - logging
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Search log files
      description: Get contents of the log file.
      responses:
        "200":
          description: List of LogSearchResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLogSearchResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: type
          in: query
          required: true
          schema:
            $ref: "#/components/schemas/LogsRequestType"
          description: type of logs request
        - name: groupId
          in: query
          required: false
          schema:
            type: string
          description: id of the group to query
        - name: files
          in: query
          required: false
          schema:
            oneOf:
              - type: string
              - type: array
                items:
                  type: string
          description: file or files to query
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of log lines to retrieve starting from offset.
        - name: et
          in: query
          required: false
          schema:
            type: integer
          description: Epoch timestamp of the earliest event (includes rolled files
            present on disk)
        - name: lt
          in: query
          required: false
          schema:
            type: integer
          description: Epoch timestamp of the latest event (includes rolled files present
            on disk)
        - name: filter
          in: query
          required: false
          schema:
            type: string
          description: Filter
  /overlay/artifacts/{binaryVersion}/{overlayId}/metadata:
    get:
      operationId: getOverlayArtifactsMetadataByBinaryVersionAndOverlayId
      tags:
        - distributed
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Download overlay-metadata.json for a given (binaryVersion, overlayId)
        pair
      description: Download the overlay-metadata.json file. Used by Worker nodes to
        inspect overlay package metadata.
      responses:
        "200":
          description: The overlay-metadata.json file
        "400":
          description: Invalid path parameter or unknown artifact type
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Artifact not found or overlay feature is disabled
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: binaryVersion
          in: path
          required: true
          schema:
            type: string
          description: The binary version this overlay targets.
        - name: overlayId
          in: path
          required: true
          schema:
            type: string
          description: The overlay identifier.
  /overlay/artifacts/{binaryVersion}/{overlayId}:
    get:
      operationId: getOverlayArtifactsByBinaryVersionAndOverlayId
      tags:
        - distributed
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Download overlay artifact tarball
      description: Download a .tar.gz archive containing all overlay artifact files
        (bundle.js, bundle.js.sig, overlay-metadata.json) for the specified
        (binaryVersion, overlayId) pair. The tarball is built on first request
        and cached for subsequent requests. Used by Worker nodes to pull overlay
        packages from the Leader.
      responses:
        "200":
          description: The overlay artifact tarball (.tar.gz)
        "400":
          description: Invalid path parameter
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Artifacts not found or overlay feature is disabled
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: binaryVersion
          in: path
          required: true
          schema:
            type: string
          description: The binary version this overlay targets.
        - name: overlayId
          in: path
          required: true
          schema:
            type: string
          description: The overlay identifier (e.g. "patch.0", "sideload.a1b2c3d").
  /overlay:
    get:
      operationId: getOverlay
      tags:
        - overlay
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List available overlay updates
      description: List overlay artifacts currently available on this leader from
        sideload and S3 cache storage. Requires admin role.
      security:
        - bearerAuth: []
        - clientOauth: []
      responses:
        "200":
          description: Available overlay artifacts
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OverlayListResponse"
        "401":
          description: Unauthorized
        "403":
          description: Forbidden - admin role required
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of overlay artifacts to return in the response for
            this request. Use with <code>offset</code> to paginate the response
            into manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /overlay/{binaryVersion}/{overlayId}:
    get:
      operationId: getOverlayByBinaryVersionAndOverlayId
      tags:
        - overlay
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get an available overlay update
      description: Get metadata for one overlay artifact currently available on this
        leader from sideload or S3 manifest state. Requires admin role.
      security:
        - bearerAuth: []
        - clientOauth: []
      responses:
        "200":
          description: Available overlay artifact
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OverlayGetResponse"
        "401":
          description: Unauthorized
        "403":
          description: Forbidden - admin role required
        "404":
          description: Overlay not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: binaryVersion
          in: path
          required: true
          schema:
            type: string
          description: The <code>binaryVersion</code> of the target Cribl binary.
        - name: overlayId
          in: path
          required: true
          schema:
            type: string
          description: The <code>overlayId</code> of the overlay artifact.
  /overlay/status:
    get:
      operationId: getOverlayStatus
      tags:
        - overlay
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get active overlay status by worker group
      description: List each connected worker's binary version and active overlay
        status, grouped by worker group. Requires admin role.
      security:
        - bearerAuth: []
        - clientOauth: []
      responses:
        "200":
          description: Overlay status by worker group
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OverlayStatusResponse"
        "401":
          description: Unauthorized
        "403":
          description: Forbidden - admin role required
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of worker groups to return in the response for this
            request. Use with <code>offset</code> to paginate the response into
            manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /overlay/refresh:
    post:
      operationId: createOverlayRefresh
      tags:
        - overlay
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Refresh available overlay updates
      description: Queue an immediate S3 manifest refresh. Requires admin role.
      security:
        - bearerAuth: []
        - clientOauth: []
      responses:
        "200":
          description: Overlay manifest refresh queued
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/OverlayRefreshResponse"
        "401":
          description: Unauthorized
        "403":
          description: Forbidden - admin role required
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Overlay manifest poller unavailable
  /overlay/sideload:
    delete:
      operationId: deleteOverlaySideload
      tags:
        - overlay
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Delete all overlay sideloads
      description: Remove all sideloaded overlay bundles from the archive directory
        and invalidate the tarball cache.<br><br> This operation is idempotent —
        if no sideloads exist, the endpoint returns an empty list with 200
        OK.<br><br> Does not affect the currently active overlay staged in the
        process execution directory. Available only in non-production
        environments. Requires admin role.
      responses:
        "200":
          description: OK — all entries removed (or empty list if no sideloads existed)
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOverlaySideloadDeleteResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Not Found — endpoint not available in production environments
        "500":
          description: Internal Server Error — failed to delete the sideload archive
            directory
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /overlay/sideload/{binaryVersion}/{overlayId}:
    delete:
      operationId: deleteOverlaySideloadByBinaryVersionAndOverlayId
      tags:
        - overlay
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Delete a sideloaded overlay
      description: Remove the sideloaded overlay bundle for the specified
        (binaryVersion, overlayId) pair from the archive directory.<br><br> This
        operation is idempotent — if the entry does not exist, the endpoint
        returns an empty list with 200 OK.<br><br> Does not affect the currently
        active overlay staged in the process execution directory. Available only
        in non-production environments. Requires admin role.
      responses:
        "200":
          description: OK — entry removed (or empty list if not found)
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOverlaySideloadDeleteResponse"
        "400":
          description: Bad Request — invalid path parameter
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Not Found — endpoint not available in production environments
        "500":
          description: Internal Server Error — failed to delete the sideload directory
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: binaryVersion
          in: path
          required: true
          schema:
            type: string
          description: The binary version (e.g. <code>4.19.0</code>).
        - name: overlayId
          in: path
          required: true
          schema:
            type: string
          description: The overlay identifier (e.g. <code>patch.0</code> or
            <code>sideload.a1b2c3d</code>).
    put:
      operationId: updateOverlaySideloadByBinaryVersionAndOverlayId
      tags:
        - overlay
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Upload an overlay bundle
      description: "Upload a signed overlay artifact tarball onto a non-production
        leader.<br><br> The URL parameters must match the bundle's
        <code>overlay-metadata.json</code>: <code>:binaryVersion</code> matches
        <code>targetBinaryVersion</code> and <code>:overlayId</code> matches
        <code>overlayId</code>.<br><br> The bundle must pass ECDSA signature
        verification against the embedded signing key.<br><br> Returns 202
        Accepted immediately; the leader stages the bundle and begins a graceful
        restart. Available only in non-production environments
        (<code>cribl-playground.cloud</code>, <code>cribl-staging.cloud</code>,
        <code>cribl-dev.cloud</code>). Requires admin role."
      responses:
        "200":
          description: The updated OverlaySideloadApplyResponse object in a single-item
            list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedOverlaySideloadApplyResponse"
        "202":
          description: Accepted — overlay bundle staged; graceful restart triggered
        "400":
          description: Bad Request — invalid path parameter, missing bundle files,
            metadata mismatch, or signature verification failure
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Not Found — endpoint not available in production environments
        "500":
          description: Internal Server Error — failed to archive the overlay bundle
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/octet-stream:
            schema:
              type: string
              format: binary
              description: Signed overlay bundle tarball (.tar.gz containing bundle.js or
                bundle.js.enc, bundle.js.sig, overlay-metadata.json)
      parameters:
        - name: binaryVersion
          in: path
          required: true
          schema:
            type: string
          description: The binary version this overlay targets (e.g. <code>4.19.0</code>).
        - name: overlayId
          in: path
          required: true
          schema:
            type: string
          description: The overlay identifier (e.g. <code>patch.0</code> or
            <code>sideload.a1b2c3d</code>).
  /packs:
    post:
      operationId: createPacks
      tags:
        - packs
      x-speakeasy-group: packs
      x-speakeasy-name-override: install
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Install a Pack
      description: Install a Pack.<br><br> To install an uploaded Pack, provide the
        <code>source</code> value from the <code>PUT /packs</code> response as
        the <code>source</code> parameter in the request body.<br><br> To
        install a Pack by importing from a URL, provide the direct URL location
        of the <code>.crbl</code> file for the Pack as the <code>source</code>
        parameter in the request body.<br><br> To install a Pack by importing
        from a Git repository, provide <code>git+<repo-url></code> as the
        <code>source</code> parameter in the request body.<br><br> If you do not
        include the <code>source</code> parameter in the request body, an empty
        Pack is created.
      responses:
        "200":
          description: The created PackInstallInfo object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPackInstallInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: packRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PackRequestBody"
            examples:
              PackInstallExamplesPackDispensary:
                $ref: "#/components/examples/PackInstallExamplesPackDispensary"
              PackInstallExamplesEmptyPack:
                $ref: "#/components/examples/PackInstallExamplesEmptyPack"
              PackInstallExamplesUploadedFile:
                $ref: "#/components/examples/PackInstallExamplesUploadedFile"
              PackInstallExamplesURL:
                $ref: "#/components/examples/PackInstallExamplesURL"
              PackInstallExamplesGitRepository:
                $ref: "#/components/examples/PackInstallExamplesGitRepository"
    get:
      operationId: getPacks
      tags:
        - packs
      x-speakeasy-group: packs
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all Packs
      description: Get a list of all Packs.
      responses:
        "200":
          description: List of PackInfo objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPackInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: with
          in: query
          required: false
          schema:
            type: string
          description: Comma-separated list of additional properties to include in the
            response. When set, the response includes a count of the specified
            properties in the Pack. Available values are <code>inputs</code> and
            <code>outputs</code>.
    put:
      operationId: updatePacks
      tags:
        - packs
      x-speakeasy-group: packs
      x-speakeasy-name-override: upload
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Upload a Pack file
      description: Upload a Pack file. Returns the <code>source</code> ID needed to
        install the Pack with <code>POST /packs</code>, which you must call
        separately.
      responses:
        "200":
          description: Pack file uploaded successfully
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/UploadPackResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        required: true
        content:
          application/octet-stream:
            schema:
              type: string
              format: binary
              description: Pack file upload
      parameters:
        - name: filename
          in: query
          required: true
          schema:
            type: string
          description: Filename of the Pack file to upload.
  /packs/{id}:
    delete:
      operationId: deletePacksById
      tags:
        - packs
      x-speakeasy-group: packs
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Uninstall a Pack
      description: Uninstall the specified Pack.
      responses:
        "200":
          description: The deleted PackUninstallInfo object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPackUninstallInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack to uninstall.
    get:
      operationId: getPacksById
      tags:
        - packs
      x-speakeasy-group: packs
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a Pack
      description: Get the specified Pack.
      responses:
        "200":
          description: List of PackInfo objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPackInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack to get.
    patch:
      operationId: updatePacksById
      tags:
        - packs
      x-speakeasy-group: packs
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Upgrade a Pack
      description: Upgrade the specified Pack.<br/><br/>If the Pack includes any
        user-modified versions of default Cribl Knowledge resources such as
        lookups, copy the modified files locally for safekeeping before
        upgrading the Pack. Copy the modified files back to the upgraded Pack
        after you install it with <code>POST /packs</code> to overwrite the
        default versions in the Pack.<br/><br/>After you upgrade the Pack,
        update any Routes, Pipelines, Sources, and Destinations that use the
        previous Pack version so that they reference the upgraded Pack.
      responses:
        "200":
          description: The updated PackInfo object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPackInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: PackUpgradeRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PackUpgradeRequest"
            examples:
              PackUpgradeExamplesUpgradeFromURL:
                $ref: "#/components/examples/PackUpgradeExamplesUpgradeFromURL"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack to upgrade.
  /packs/__clone__:
    post:
      operationId: createPacksClone
      tags:
        - packs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Clone a Pack
      description: Clone one or more Packs from a source Worker Group or Edge Fleet to
        one or more destination Group or Fleet. Useful for migrating and
        duplicating Packs among Worker Groups or Edge Fleets in Distributed
        deployments. Cloning across different products, such as Cribl Stream to
        Edge, is not supported.
      responses:
        "200":
          description: The created InstalledPacksResponse object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/InstalledPacksResponse"
        "400":
          description: Bad Request — missing or invalid request body (for example,
            <code>srcGroup</code>, <code>dstGroups</code>, or
            <code>packs</code>)
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden — no read access to source group
        "404":
          description: Source or destination Worker Group or Edge Fleet not found
        "405":
          description: Operation not allowed (for example, only available on Leader,
            cross-product cloning not supported)
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: PackClone object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PackClone"
            examples:
              PackCloneExamplesCloneToSingleGroup:
                $ref: "#/components/examples/PackCloneExamplesCloneToSingleGroup"
              PackCloneExamplesCloneToMultipleGroups:
                $ref: "#/components/examples/PackCloneExamplesCloneToMultipleGroups"
      parameters:
        - name: cloneDependencies
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, clone the Worker Group- or Edge Fleet-level
            dependencies (secrets, variables, and certificates) along with the
            Packs. If omitted or <code>false</code>, clone only the Packs.
  /packs/{id}/refs:
    get:
      operationId: getPacksRefsById
      tags:
        - packs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get Pack references
      description: Get all entities within the specified Pack that reference objects
        from outside the Pack (also called cross-object dependencies). Useful
        for identifying referenced certificates, secrets, variables, and other
        resources that are not defined within the Pack itself before modifying
        or exporting the Pack.
      responses:
        "200":
          description: List of ReferencingEntity objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedReferencingEntity"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack.
  /packs/{id}/export:
    get:
      operationId: getPacksExportById
      tags:
        - packs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Export a Pack
      description: Export the specified Pack as a downloadable <code>.crbl</code> file.
      responses:
        "200":
          description: The requested Response object.
          content:
            application/octet-stream:
              schema:
                type: object
                additionalProperties: true
        "400":
          description: Bad Request — missing or invalid <code>mode</code> query parameter
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Pack not found
        "409":
          description: Conflict — export conflicts detected (for example, merge conflicts)
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack to export.
        - name: mode
          in: query
          required: true
          schema:
            $ref: "#/components/schemas/PackExportModeTypes"
          description: "Mode to use when exporting the Pack configuration. The
            <code>merge</code> mode force-merges local modifications into the
            Pack configuration and deletes encrypted fields during export. Use
            <code>default_only</code> mode to export only the original
            configuration for the Pack, ignoring any local modifications and
            preserving encrypted fields. NOTE: <code>merge_safe</code> is
            deprecated. Use <code>merge</code> instead."
        - name: filename
          in: query
          required: false
          schema:
            type: string
          description: Custom filename to use for the exported Pack.
  /packs/{id}/publish:
    post:
      operationId: createPacksPublishById
      tags:
        - packs
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Publish a Pack
      description: Publish the current state of the specified Pack to the external Git
        repository that it was originally imported from. Synchronizes local
        changes with the remote repository. Supported only for Packs that were
        originally imported from a Git URL with embedded authentication (token
        or SSH).
      responses:
        "200":
          description: The created PublishPackResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPublishPackResponse"
        "400":
          description: Bad Request — publish failed (for example, validation or Git push
            error)
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Pack not found
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Pack to publish.
  /preview:
    post:
      operationId: createPreview
      tags:
        - preview
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Send sample events through a Pipeline and review results
      description: Send sample events through the specified Pipeline. The response
        contains an array of objects, each showing the transformations,
        additions, and removals for an event after it passes through the
        pipeline. Useful for testing Pipeline logic with sample data before
        deploying changes.
      responses:
        "200":
          description: The created PreviewResponse object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PreviewResponse"
        "400":
          description: Bad Request — invalid request (for example, invalid
            <code>memory</code>, forbidden <code>sampleId</code> path,
            unsupported <code>mode</code>)
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: PreviewDataParams object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PreviewDataParams"
            examples:
              PreviewExamplesPipeModeWithEvents:
                $ref: "#/components/examples/PreviewExamplesPipeModeWithEvents"
              PreviewExamplesPipeModeWithSample:
                $ref: "#/components/examples/PreviewExamplesPipeModeWithSample"
              PreviewExamplesRouteMode:
                $ref: "#/components/examples/PreviewExamplesRouteMode"
      parameters:
        - name: product
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/ProductsBase"
          description: "The product context to target in the preview operation. In the
            Leader context, determines the correct Pipeline ID prefix: if
            <code>stream</code>, the prefix is <code>ruleset</code>; if
            <code>edge</code>, the prefix is <code>fleet-ruleset</code>. If
            omitted in the Leader context, the endpoint falls back to deprecated
            behavior and uses the path to determine the prefix. Ignored if the
            <code>pipelineId</code> already includes a prefix."
  /system/projects/{projectId}/preview:
    post:
      operationId: createSystemProjectsPreviewByProjectId
      tags:
        - preview
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Send sample events through a Pipeline and review results within a Project
      description: Sends sample events through a Pipeline for specified Project and
        returns the results.
      responses:
        "200":
          description: The created PreviewResponse object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PreviewResponse"
        "400":
          description: Bad Request — invalid request (for example, invalid
            <code>memory</code>, forbidden <code>sampleId</code> path,
            unsupported <code>mode</code>)
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: PreviewDataParams object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PreviewDataParams"
            examples:
              PreviewExamplesPipeModeWithEvents:
                $ref: "#/components/examples/PreviewExamplesPipeModeWithEvents"
              PreviewExamplesPipeModeWithSample:
                $ref: "#/components/examples/PreviewExamplesPipeModeWithSample"
              PreviewExamplesRouteMode:
                $ref: "#/components/examples/PreviewExamplesRouteMode"
      parameters:
        - name: product
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/ProductsBase"
          description: "The product context to target in the preview operation. In the
            Leader context, determines the correct Pipeline ID prefix: if
            <code>stream</code>, the prefix is <code>ruleset</code>; if
            <code>edge</code>, the prefix is <code>fleet-ruleset</code>. If
            omitted in the Leader context, the endpoint falls back to deprecated
            behavior and uses the path to determine the prefix. Ignored if the
            <code>pipelineId</code> already includes a prefix."
        - name: projectId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Project.
      x-speakeasy-group: projects.preview
      deprecated: true
  /system/processes:
    get:
      operationId: getSystemProcesses
      tags:
        - processes
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List all processes
      description: Get a list of processes under management.
      responses:
        "200":
          description: List of ProcessEntry objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedProcessEntry"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /products/{product}/users/{id}/acl:
    get:
      operationId: getProductsUsersAclByProductAndId
      tags:
        - users
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get User Access Control List
      description: Get user's Access Control List.
      responses:
        "200":
          description: List of ResourcePolicy objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedResourcePolicy"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsAll"
          description: product by which to filter members
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: user id
        - name: type
          in: query
          required: false
          schema:
            $ref: "#/components/schemas/RbacResource"
          description: resource type by which to filter access levels
  /products/{product}/users:
    get:
      operationId: getProductsUsersByProduct
      tags:
        - users
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List Members for a product
      description: Get Users belonging to a product.
      responses:
        "200":
          description: List of User objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUser"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsAll"
          description: product by which to filter members
        - name: groupId
          in: query
          required: false
          schema:
            type: string
          description: filter to specific group by groupId
  /products/{product}/users/__cache__:
    delete:
      operationId: deleteProductsUsersCacheByProduct
      tags:
        - users
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Invalidate the Members cache
      description: Invalidate the members cache for a given product in SaaS deployment.
      responses:
        "200":
          description: The deleted any object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedObject"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/ProductsAll"
          description: product by which to filter members
  /system/projects/{project}/version/commit:
    post:
      operationId: createSystemProjectsVersionCommitByProject
      tags:
        - versioning
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Commit Project Changes
      description: Commit project changes.
      deprecated: true
      responses:
        "200":
          description: The created GitCommitSummary object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitCommitSummary"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: ProjectGitCommitParams object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/ProjectGitCommitParams"
      parameters:
        - name: project
          in: path
          required: true
          schema:
            type: string
          description: Project
  /system/projects/{project}/version/count:
    get:
      operationId: getSystemProjectsVersionCountByProject
      tags:
        - versioning
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get changed file count for a Project
      description: get the count of files of changed.
      deprecated: true
      responses:
        "200":
          description: List of GitCountResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitCountResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: project
          in: path
          required: true
          schema:
            type: string
          description: Project
        - name: commit
          in: query
          required: false
          schema:
            type: string
          description: Commit ID
  /system/projects/{project}/version/diff:
    get:
      operationId: getSystemProjectsVersionDiffByProject
      tags:
        - versioning
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the diff for a Project
      description: get the textual diff for given commit.
      deprecated: true
      responses:
        "200":
          description: List of GitDiffResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitDiffResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: project
          in: path
          required: true
          schema:
            type: string
          description: Project
        - name: commit
          in: query
          required: false
          schema:
            type: string
          description: Commit hash (default is HEAD)
        - name: filename
          in: query
          required: false
          schema:
            type: string
          description: Filename
        - name: diffLineLimit
          in: query
          required: false
          schema:
            type: integer
          description: Limit maximum lines in the diff
  /system/projects/{project}/version/files:
    get:
      operationId: getSystemProjectsVersionFilesByProject
      tags:
        - versioning
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List changed files for a Project
      description: get the files changed.
      deprecated: true
      responses:
        "200":
          description: List of GitFilesResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitFilesResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: project
          in: path
          required: true
          schema:
            type: string
          description: Project
        - name: commit
          in: query
          required: false
          schema:
            type: string
          description: Commit ID
  /system/projects/{project}/version/revert:
    post:
      operationId: createSystemProjectsVersionRevertByProject
      tags:
        - versioning
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Revert Project changes
      description: Revert project changes.
      deprecated: true
      responses:
        "200":
          description: The created GitRevertResult object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitRevertResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: GitRevertParams object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GitRevertParams"
      parameters:
        - name: project
          in: path
          required: true
          schema:
            type: string
          description: Project
  /system/projects/{project}/version/show:
    get:
      operationId: getSystemProjectsVersionShowByProject
      tags:
        - versioning
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List Project changes
      description: Show project changes.
      deprecated: true
      responses:
        "200":
          description: List of GitShowResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitShowResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: project
          in: path
          required: true
          schema:
            type: string
          description: Project
        - name: commit
          in: query
          required: false
          schema:
            type: string
          description: Commit ID
        - name: filename
          in: query
          required: false
          schema:
            type: string
          description: Filename
        - name: diffLineLimit
          in: query
          required: false
          schema:
            type: integer
          description: Limit maximum lines in the diff
  /system/info:
    get:
      operationId: getSystemInfo
      tags:
        - diag
      x-speakeasy-group: system.info
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get system information
      description: Get basic system information for the current Cribl instance.
      responses:
        "200":
          description: Basic system information
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSystemInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: fields
          in: query
          required: false
          schema:
            type: string
          description: Comma-separated list of <code>SystemInfoField</code> values to
            include in the response.
        - name: messages
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include system messages in the response.
        - name: conf
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include a configuration summary in the
            response.
  /system/diag/download:
    get:
      operationId: getSystemDiagDownload
      tags:
        - diag
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Download a diagnostic bundle (tar.gz archive)
      description: Download a diagnostic bundle (tar.gz archive) for a Cribl Leader,
        Worker, or Edge Node. Useful for troubleshooting.
      responses:
        "200":
          content:
            application/tar+gzip:
              schema:
                type: string
                format: binary
          description: A tar.gz file consisting all configuration files and recent logs
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: path
          in: query
          required: false
          schema:
            type: string
          description: Filesystem path to the diagnostic bundle.
        - name: renameJs
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, rename <code>.js</code> files to
            <code>.txt</code> in the diagnostic bundle to prevent false
            positives in antivirus software. Default is <code>false</code>.
        - name: maxIncludeJobs
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of jobs and their associated tasks to include in the
            diagnostic bundle. If omitted, the bundle includes all available
            jobs, with no upper limit.
        - name: debug
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include debug information in the diagnostic
            bundle. Default is <code>false</code>.
        - name: includeMetrics
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code> (default), include metrics in the diagnostic
            bundle.
        - name: includeGit
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code> (default), include the Git audit log in the
            diagnostic bundle. Not supported for <code>worker</code>,
            <code>managed-edge</code>, and <code>outpost</code> modes.
        - name: includeTopTalkers
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include data about the 10 highest-volume
            Sources, Destinations, Pipelines, Routes, and Packs in the
            diagnostic bundle. Default is <code>false</code>.
        - name: includeInstallLogs
          in: query
          required: false
          schema:
            type: boolean
          description: If <code>true</code>, include installation logs in the diagnostic
            bundle. Windows only. Default is <code>false</code>.
        - name: maxLogFiles
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of rotated log files to include in the diagnostic
            bundle per log type. If omitted, the bundle includes all log files
            on disk, with no upper limit.
  /system/diag:
    get:
      operationId: getSystemDiag
      tags:
        - diag
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List existing diagnostic bundles
      description: Get a list of existing diagnostic bundles for a Cribl Leader,
        Worker, or Edge Node. Useful for viewing available diagnostic bundles
        before downloading, sending, or removing them.
      responses:
        "200":
          description: List of diagnostic bundles
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDiag"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    delete:
      operationId: deleteSystemDiag
      tags:
        - diag
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Remove a diagnostic bundle
      description: Remove the specified diagnostic bundle.
      responses:
        "200":
          description: Success
        "400":
          description: Cannot remove bundles outside of diag directory
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: path
          in: query
          required: true
          schema:
            type: string
          description: Filesystem path to the diagnostic bundle to remove. Use <code>GET
            /system/diag</code> to get the <code>path</code>.
  /system/diag/send:
    post:
      operationId: createSystemDiagSend
      tags:
        - diag
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Send a diagnostic bundle (tar.gz archive) to Cribl
      description: Send a diagnostic bundle (tar.gz archive) from a Cribl Leader,
        Worker, or Edge Node to Cribl Support. Useful for troubleshooting.
      responses:
        "200":
          description: Success message
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SendDiagBundle object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SendDiagBundle"
            examples:
              SendDiagBundleExamplesSendToSupport:
                $ref: "#/components/examples/SendDiagBundleExamplesSendToSupport"
  /system/metrics/enum:
    post:
      operationId: createSystemMetricsEnum
      tags:
        - metrics
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Enumerate system metrics and dimensions
      description: Enumerate available system metric names and their dimensions.
      responses:
        "200":
          description: Enumerated system metric names and dimensions
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMetricNameInfo"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SystemMetricsEnum object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SystemMetricsEnum"
            examples:
              SystemMetricsEnumExamplesfullFidelity:
                $ref: "#/components/examples/SystemMetricsEnumExamplesfullFidelity"
  /system/metrics:
    get:
      operationId: getSystemMetrics
      tags:
        - metrics
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Query system metrics
      description: Query raw internal system metrics.
      responses:
        "200":
          description: The requested QueryResultsEnvelop object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/QueryResultsEnvelop"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: wp
          in: query
          required: false
          schema:
            type: integer
          description: Worker Process index to query. Supported only on Worker Nodes.
        - name: numBuckets
          in: query
          required: false
          schema:
            type: integer
          description: Number of time buckets to include in the query results.
        - name: earliest
          in: query
          required: false
          schema:
            type:
              - string
              - number
          description: Start of the query time range. Accepts a relative time string (for
            example, <code>-1h</code>) or a timestamp in Unix time
            (milliseconds).
        - name: latest
          in: query
          required: false
          schema:
            type:
              - string
              - number
          description: End of the query time range. Accepts a relative time string (for
            example, <code>now</code>) or a timestamp in Unix time
            (milliseconds).
        - name: metricNameFilter
          in: query
          required: false
          schema:
            oneOf:
              - type: string
              - type: array
                items:
                  type: string
          description: Metric names to filter by. Accepts a regular expression or an array
            of metric names.
        - name: filterExpr
          in: query
          required: false
          schema:
            type: string
          description: Filter expression applied to returned metrics. Supports filtering
            by dimension values.
        - name: namespace
          in: query
          required: false
          schema:
            type: string
          description: Metrics store namespace. If omitted, uses the default metrics store.
  /system/metrics/query:
    post:
      operationId: createSystemMetricsQuery
      tags:
        - metrics
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Aggregate raw system metrics
      description: Aggregate raw internal system metrics.
      responses:
        "200":
          description: Aggregated system metrics query results
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CriblEventEnvelop"
              examples:
                SystemMetricsQueryResponseExamplescumulativeBySource:
                  $ref: "#/components/examples/SystemMetricsQueryResponseExamplescumulativeBySour\
                    ce"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SystemMetricsQueryRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SystemMetricsQueryRequest"
            examples:
              SystemMetricsQueryExamplescumulativeByInput:
                $ref: "#/components/examples/SystemMetricsQueryExamplescumulativeByInput"
              SystemMetricsQueryExamplesnamespaceWithSplits:
                $ref: "#/components/examples/SystemMetricsQueryExamplesnamespaceWithSplits"
  /system/settings/auth:
    get:
      operationId: getSystemSettingsAuth
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get authentication settings
      description: Get the authentication settings for the Cribl
        deployment.<br/><br/>The response never includes stored credential
        secrets in plaintext. Sensitive attributes such as LDAP
        <code>bindCredentials</code> and OpenID <code>client_secret</code> are
        replaced with non-recoverable placeholders in responses.
      responses:
        "200":
          description: Authentication settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAuthConfig"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSystemSettingsAuth
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update authentication settings
      description: Update the authentication settings for the Cribl
        deployment.<br/><br/>Provide a complete representation of the
        authentication settings that you want to update in the request body.
        This endpoint does not support partial updates. Cribl removes any
        omitted fields when updating the authentication
        settings.<br/><br/>Confirm that the configuration in your request body
        is correct before sending the request. If the configuration is
        incorrect, the updated authentication settings might not function as
        expected.<br/><br/>The response never includes stored credential secrets
        in plaintext. Sensitive attributes such as LDAP
        <code>bindCredentials</code> and OpenID <code>client_secret</code> are
        replaced with non-recoverable placeholders in responses.
      responses:
        "200":
          description: Updated authentication settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedAuthConfig"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AuthConfig object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AuthConfig"
            examples:
              UpdateAuthExamplesLocalAuth:
                $ref: "#/components/examples/UpdateAuthExamplesLocalAuth"
              UpdateAuthExamplesLdapAuth:
                $ref: "#/components/examples/UpdateAuthExamplesLdapAuth"
  /system/settings/conf:
    get:
      operationId: getSystemSettingsConf
      tags:
        - system
      x-speakeasy-group: system.settings.cribl
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get system settings
      description: Get Cribl system settings.
      responses:
        "200":
          description: List of SystemSettingsConf objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSystemSettingsConf"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSystemSettingsConf
      tags:
        - system
      x-speakeasy-group: system.settings.cribl
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update system settings
      description: Update Cribl system settings.
      responses:
        "200":
          description: The updated SystemSettingsConf object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSystemSettingsConf"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SystemSettingsConf object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SystemSettingsConf"
            examples:
              UpdateSystemSettingsExamplesUpdateApiSettings:
                $ref: "#/components/examples/UpdateSystemSettingsExamplesUpdateApiSettings"
  /system/settings/git-settings:
    get:
      operationId: getSystemSettingsGitSettings
      tags:
        - git
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get git settings
      description: Get the current Git integration settings for the Cribl deployment.
      responses:
        "200":
          description: Git settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitSettings"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSystemSettingsGitSettings
      tags:
        - git
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update git settings
      description: Update the Git integration settings for the Cribl deployment.
      responses:
        "200":
          description: Updated Git settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitSettings"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: GitSettings object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GitSettings"
            examples:
              UpdateGitSettingsExamplesHttpsRemote:
                $ref: "#/components/examples/UpdateGitSettingsExamplesHttpsRemote"
              UpdateGitSettingsExamplesSshRemote:
                $ref: "#/components/examples/UpdateGitSettingsExamplesSshRemote"
  /system/search-limits:
    get:
      operationId: getSystemSearchLimits
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get search limits
      description: Get the search limits configuration.
      responses:
        "200":
          description: Search limits configuration
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchSettings"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/settings:
    get:
      operationId: getSystemSettings
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get system settings
      description: Get Cribl system settings. Deprecated. <br/><br/>Use
        <code>/system/limits</code>, <code>/system/job-limits</code>,
        <code>/system/redis-cache-limits</code>,  <code>/system/services-limits</code>,
        <code>GET /system/settings/git-settings</code>,  and <code>GET
        /system/settings/conf</code> instead.
      deprecated: true
      responses:
        "200":
          description: List of SystemSettings objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSystemSettings"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    patch:
      operationId: updateSystemSettings
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update Cribl system settings
      description: Update Cribl system settings. Deprecated. <br/><br/>Use
        <code>/system/limits</code>, <code>/system/job-limits</code>,
        <code>PATCH /system/settings/git-settings</code>, <code>PATCH
        /system/settings/auth</code>, and <code>PATCH
        /system/settings/conf</code> instead.
      deprecated: true
      responses:
        "200":
          description: The updated SystemSettings object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSystemSettings"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/settings/cribl:
    get:
      operationId: getSystemSettingsCribl
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get public system settings for Cribl
      description: Get public system settings for Cribl. Visible to all logged-in
        Members, regardless of their assigned access rights.
      responses:
        "200":
          description: Public system settings for Cribl
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPublicSettings"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/settings/upgrade:
    get:
      operationId: getSystemSettingsUpgrade
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List Cribl versions available for upgrade
      description: Get a list of Cribl versions that are compatible with your platform
        and available for upgrade based on your currently installed version. If
        you are already on the latest version (no upgrades are available), the
        response indicates that the installed version is up to date.
      responses:
        "200":
          description: A list of available Cribl versions for upgrade
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedUpgradeResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/settings/reload:
    post:
      operationId: createSystemSettingsReload
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Reload Cribl settings
      description: Reload Cribl settings from the filesystem. Useful for applying
        configuration changes without restarting the service to minimize data
        flow disruption.
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSystemReloadResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/settings/restart:
    post:
      operationId: createSystemSettingsRestart
      tags:
        - system
      x-speakeasy-group: system.settings
      x-speakeasy-name-override: restart
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Restart the Cribl server
      description: Restart the Cribl server. Useful for applying configuration changes
        that require a full process restart, such as changes to system-level
        settings that cannot be applied by reloading.
      responses:
        "200":
          description: Success
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSystemRestartResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system/settings/upgrade/{version}:
    post:
      operationId: createSystemSettingsUpgradeByVersion
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Upgrade Cribl to a specific version
      description: Upgrade Cribl to the specified target version. Get the target
        version string for the request URL from
        <code>availableVersions.fullVersion</code> in the response to a
        <code>GET /system/settings/upgrade</code> request.
      responses:
        "200":
          description: Upgrade result
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Forbidden
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: version
          in: path
          required: true
          schema:
            type: string
          description: The target version string for the version to upgrade to. Get from
            <code>availableVersions.fullVersion</code> in the <code>GET
            /system/settings/upgrade</code> response.
  /system/settings/upgrade-from-package:
    post:
      operationId: createSystemSettingsUpgradeFromPackage
      tags:
        - system
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Upgrade with a package
      description: Upgrade the Leader Node with the specified package.
      responses:
        "200":
          description: Upgrade result
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "400":
          description: Bad Request
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: upgradeMaster object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpgradeMasterRequest"
            examples:
              UpgradeFromPackageExamplesUpgradeWithPackage:
                $ref: "#/components/examples/UpgradeFromPackageExamplesUpgradeWithPackage"
  /ui/{key}:
    get:
      operationId: getUiByKey
      tags:
        - uiState
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get UI state
      description: Get UI state by key.
      responses:
        "200":
          description: List of any objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedObject"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: key
          in: path
          required: true
          schema:
            type: string
          description: UI state key
    patch:
      operationId: updateUiByKey
      tags:
        - uiState
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Update UI State
      description: Update UI state by key.
      responses:
        "200":
          description: The updated any object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedObject"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: UI State Patch object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UiStatePatch"
      parameters:
        - name: key
          in: path
          required: true
          schema:
            type: string
          description: UI state key
  /version/branch:
    get:
      operationId: getVersionBranch
      tags:
        - versioning
      x-speakeasy-group: versions.branches
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List all branches in the Git repository used for Cribl configuration
      description: Get a list of all branches in the Git repository used for Cribl
        configuration.
      responses:
        "200":
          description: List of BranchInfo objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBranchInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /version/commit:
    post:
      operationId: createVersionCommit
      tags:
        - versioning
      x-speakeasy-group: versions.commits
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create a new commit for pending changes to the Cribl configuration
      description: Create a new commit for pending changes to the Cribl configuration.
        Any merge conflicts indicated in the response must be resolved using
        Git.</br></br> To commit only a subset of configuration changes, specify
        the files to include in the commit in the <code>files</code> array.
      responses:
        "200":
          description: The created GitCommitSummary object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitCommitSummary"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: GitCommitBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GitCommitBody"
            examples:
              VersionCommitExamplesCommitAll:
                $ref: "#/components/examples/VersionCommitExamplesCommitAll"
              VersionCommitExamplesCommitSpecificFiles:
                $ref: "#/components/examples/VersionCommitExamplesCommitSpecificFiles"
  /version/count:
    get:
      operationId: getVersionCount
      tags:
        - versioning
      x-speakeasy-group: versions.commits.files
      x-speakeasy-name-override: count
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get a count of files that changed since a commit
      description: Get a count of the files that changed since a commit. Default is
        the latest commit (HEAD).
      responses:
        "200":
          description: List of GitCountResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitCountResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: commit
          in: query
          required: false
          schema:
            type: string
          description: The Git commit hash to use as the starting point for the count.
  /version/current-branch:
    get:
      operationId: getVersionCurrentBranch
      tags:
        - versioning
      x-speakeasy-group: versions.branches
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the name of the Git branch that the Cribl configuration is checked
        out to
      description: Get the name of the Git branch that the Cribl configuration is
        checked out to. Useful for verifying the active configuration branch.
      responses:
        "200":
          description: The requested CurrentBranchResult object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CurrentBranchResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /version/diff:
    get:
      operationId: getVersionDiff
      tags:
        - versioning
      x-speakeasy-group: versions.commits
      x-speakeasy-name-override: diff
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the diff for a commit
      description: Get the diff for a commit. Default is the latest commit (HEAD).
      responses:
        "200":
          description: List of GitDiffResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitDiffResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: commit
          in: query
          required: false
          schema:
            type: string
          description: The Git commit hash to get the diff for.
        - name: filename
          in: query
          required: false
          schema:
            type: string
          description: The relative path of the file to get the diff for.
        - name: diffLineLimit
          in: query
          required: false
          schema:
            type: integer
          description: Number of lines of the diff to return. Default is 1000. Set to
            <code>0</code> to return the full diff, regardless of the number of
            lines.
  /version/files:
    get:
      operationId: getVersionFiles
      tags:
        - versioning
      x-speakeasy-group: versions.commits.files
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the names and statuses of files that changed since a commit
      description: Get the names and statuses of files that changed since a commit.
        Default is the latest commit (HEAD).
      responses:
        "200":
          description: List of GitFilesResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitFilesResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: commit
          in: query
          required: false
          schema:
            type: string
          description: The Git commit hash to use as the starting point for the request.
  /version/info:
    get:
      operationId: getVersionInfo
      tags:
        - versioning
      x-speakeasy-group: versions.configs
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the configuration and status for the Git integration
      description: Get the configuration and versioning status for the Git integration
        for the Cribl configuration.
      responses:
        "200":
          description: List of GitInfo objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitInfo"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /version:
    get:
      operationId: getVersion
      tags:
        - versioning
      x-speakeasy-group: versions.commits
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List the commit history
      description: List the commit history.</br></br> Analogous to <code>git
        log</code> for the Cribl configuration, allowing you to audit and review
        changes over time.
      responses:
        "200":
          description: List of GitLogResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitLogResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: count
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of commits to return in the response for this request.
  /version/push:
    post:
      operationId: createVersionPush
      tags:
        - versioning
      x-speakeasy-group: versions.commits
      x-speakeasy-name-override: push
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Push local commits to the remote repository
      description: Push all local commits from the local repository to the remote
        repository.
      responses:
        "200":
          description: The created string object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /version/revert:
    post:
      operationId: createVersionRevert
      tags:
        - versioning
      x-speakeasy-group: versions.commits
      x-speakeasy-name-override: revert
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Revert a commit in the local repository
      description: Revert a commit in the local repository.
      responses:
        "200":
          description: The created GitRevertResult object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitRevertResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: GitRevertParams object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/GitRevertParams"
            examples:
              VersionRevertExamplesRevertCommit:
                $ref: "#/components/examples/VersionRevertExamplesRevertCommit"
              VersionRevertExamplesForceRevertWithMessage:
                $ref: "#/components/examples/VersionRevertExamplesForceRevertWithMessage"
  /version/show:
    get:
      operationId: getVersionShow
      tags:
        - versioning
      x-speakeasy-group: versions.commits
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the diff and log message for a commit
      description: Get the diff and log message for a commit. Default is the latest
        commit (HEAD).
      responses:
        "200":
          description: List of GitShowResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitShowResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: commit
          in: query
          required: false
          schema:
            type: string
          description: The Git commit hash to retrieve the diff and log message for.
        - name: filename
          in: query
          required: false
          schema:
            type: string
          description: The relative path of the file to get the diff and log message for.
        - name: diffLineLimit
          in: query
          required: false
          schema:
            type: integer
          description: Number of lines of the diff to return. Default is 1000. Set to
            <code>0</code> to return the full diff, regardless of the number of
            lines.
  /version/status:
    get:
      operationId: getVersionStatus
      tags:
        - versioning
      x-speakeasy-group: versions.statuses
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the status of the current working tree
      description: Get the status of the current working tree of the Git repository
        used for Cribl configuration. The response includes details about
        modified, staged, untracked, and conflicted files, as well as branch and
        remote tracking information.
      responses:
        "200":
          description: List of GitStatusResult objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitStatusResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /version/sync:
    post:
      operationId: createVersionSync
      tags:
        - versioning
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Synchronize the local branch with the remote repository
      description: Synchronize the local branch with the remote repository. Any merge
        conflicts indicated in the response must be resolved using Git.
      responses:
        "200":
          description: The created GitSyncResult object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedGitSyncResult"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /version/undo:
    post:
      operationId: createVersionUndo
      tags:
        - versioning
      x-speakeasy-group: versions.commits
      x-speakeasy-name-override: undo
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Discard uncommitted (staged) changes
      description: Discard all uncommitted (staged) configuration changes, resetting
        the working directory to the last committed state. Use only if you are
        certain that you do not need to preserve your local changes.
      responses:
        "200":
          description: The created boolean object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedBoolean"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /ai/settings/dataset-intelligence/{datasetId}:
    post:
      operationId: createAiSettingsDatasetIntelligenceByDatasetId
      tags:
        - ai-settings
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Generate dataset intelligence for a dataset
      description: Kicks off an asynchronous run of the dataset intelligence agent.
        Writes a <code>processing</code> marker to disk and returns 201
        immediately. Poll the <code>GET</code> endpoint to track progress until
        <code>status</code> becomes <code>complete</code>, <code>partial</code>,
        or <code>failed</code>.<br/><br/>The caller must have read access to the
        specified dataset.
      responses:
        "201":
          description: Processing marker written; agent run dispatched
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiDatasetIntelligence"
        "400":
          description: Invalid dataset ID
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: AI is disabled, consent not accepted, or Search Investigations
            feature is off
        "404":
          description: Dataset not found or caller lacks read access
        "409":
          description: A fresh generation is already in progress for this dataset
        "500":
          description: Failed to write the processing marker
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: datasetId
          in: path
          required: true
          schema:
            type: string
          description: The dataset to analyze.
    delete:
      operationId: deleteAiSettingsDatasetIntelligenceByDatasetId
      tags:
        - ai-settings
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Delete dataset intelligence for a dataset
      description: Removes the intelligence file for the specified dataset. Idempotent
        — returns 204 whether or not a file existed.
      responses:
        "204":
          description: Intelligence file removed (or did not exist)
        "400":
          description: Invalid dataset ID
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: AI is disabled, consent not accepted, or Search Investigations
            feature is off
        "404":
          description: Dataset not found or caller lacks read access
        "500":
          description: Failed to remove the intelligence file
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: datasetId
          in: path
          required: true
          schema:
            type: string
          description: The dataset whose intelligence file to remove.
    get:
      operationId: getAiSettingsDatasetIntelligenceByDatasetId
      tags:
        - ai-settings
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get dataset intelligence for a dataset
      description: Returns the persisted dataset intelligence envelope for the
        specified dataset, including the agent's lifecycle <code>status</code>
        and the markdown <code>content</code>. Use this endpoint to poll for
        completion after creating a new run with <code>POST</code>.
      responses:
        "200":
          description: Dataset intelligence envelope
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiDatasetIntelligence"
        "400":
          description: Invalid dataset ID
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: AI is disabled, consent not accepted, or Search Investigations
            feature is off
        "404":
          description: Dataset not found, no intelligence file exists, or caller lacks
            read access
        "500":
          description: Failed to read the intelligence file
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: datasetId
          in: path
          required: true
          schema:
            type: string
          description: The dataset whose intelligence file to fetch.
    patch:
      operationId: updateAiSettingsDatasetIntelligenceByDatasetId
      tags:
        - ai-settings
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Edit dataset intelligence content
      description: Replaces the markdown <code>content</code> of an existing dataset
        intelligence file. Lifecycle fields (<code>status</code>,
        <code>generatedAt</code>) are preserved; <code>updatedAt</code> is set
        to the server's current time. Cannot be used while <code>status</code>
        is <code>processing</code>.
      responses:
        "200":
          description: Updated dataset intelligence envelope
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiDatasetIntelligence"
        "400":
          description: Invalid dataset ID or missing <code>content</code> string
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: AI is disabled, consent not accepted, or Search Investigations
            feature is off
        "404":
          description: Dataset not found, no intelligence file exists, or caller lacks
            read access
        "409":
          description: Cannot edit while a generation is in progress
        "413":
          description: Content exceeds the maximum character limit
        "500":
          description: Failed to persist the update
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AiDatasetIntelligenceUpdateRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AiDatasetIntelligenceUpdateRequest"
            examples:
              UpdateAiDatasetIntelligenceExamplesEditedSummary:
                $ref: "#/components/examples/UpdateAiDatasetIntelligenceExamplesEditedSummary"
      parameters:
        - name: datasetId
          in: path
          required: true
          schema:
            type: string
          description: The dataset whose intelligence file to update.
  /ai/event:
    post:
      operationId: createAiEvent
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Forward AI usage events to the Cribl AI backend
      description: Forward AI usage events to the Cribl AI backend as JSON
        payloads.<br/><br/>To activate this service, an Owner or Admin must
        explicity consent to use AI features for the deployment and must **not**
        have disabled AI with the <code>DISABLED_AI</code> environment variable
        or the <code>disabled</code> flag in the <code>ai.yml</code>
        configuration file.
      responses:
        "200":
          description: Response from the AI backend (JSON or empty), proxied with the
            upstream status code
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: AI consent not accepted or AI is disabled
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AiEventProxyRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AiEventProxyRequest"
            examples:
              PostAiEventExamplesCopilotAnalyticsEvent:
                $ref: "#/components/examples/PostAiEventExamplesCopilotAnalyticsEvent"
  /ai/settings/providers:
    delete:
      operationId: deleteAiSettingsProviders
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Delete the custom AI Provider
      description: Delete the current custom AI Provider.
      responses:
        "200":
          description: Provider deleted
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiSettingsEmptyResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Failed to delete Provider
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    get:
      operationId: getAiSettingsProviders
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the custom AI Provider configuration
      description: Get the configuration for the current custom AI Provider. The
        response omits sensitive information like API keys.
      responses:
        "200":
          description: Provider metadata and non-secret configuration, or an empty object
            when none is configured
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiCustomProviderGetResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Failed to load Provider settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createAiSettingsProviders
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Create or replace the custom AI Provider
      description: "|   Creates or replaces the custom AI
        Provider.   <code>configuration.credential</code> accepts
        <code>null</code> to reuse the currently stored credentials;   pass a
        non-empty string to set the key. Omitting <code>credential</code> or
        sending an empty string is rejected."
      responses:
        "200":
          description: Provider saved
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiSettingsEmptyResponse"
        "400":
          description: Validation error or persistence failure
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AiProvider object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AiProvider"
            examples:
              SetAiCustomProviderExamplesBedrockProvider:
                $ref: "#/components/examples/SetAiCustomProviderExamplesBedrockProvider"
              SetAiCustomProviderExamplesAzureOpenAIProvider:
                $ref: "#/components/examples/SetAiCustomProviderExamplesAzureOpenAIProvider"
  /ai/settings/agents.md/{product}:
    get:
      operationId: getAiSettingsAgentsMdByProduct
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get agents.md for a product
      description: Get the content of the agents.md file for the specified Cribl product.
      responses:
        "200":
          description: Content of agents.md
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiAgentsMdContentResponse"
        "400":
          description: Invalid product
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Failed to read agents.md
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/AiAgentsMdProduct"
          description: Cribl product key for the agents.md file.
    post:
      operationId: createAiSettingsAgentsMdByProduct
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update agents.md for a product
      description: Replace the content of the agents.md file for the specified product.
      responses:
        "200":
          description: Content of agents.md
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiAgentsMdContentResponse"
        "400":
          description: Invalid product or missing <code>content</code> string
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Failed to save agents.md
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AiAgentsMdContentRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AiAgentsMdContentRequest"
            examples:
              UpdateAiAgentsMdExamplesAgentsInstructions:
                $ref: "#/components/examples/UpdateAiAgentsMdExamplesAgentsInstructions"
      parameters:
        - name: product
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/AiAgentsMdProduct"
          description: Cribl product key for the agents.md file.
  /ai/settings/disabled:
    get:
      operationId: getAiSettingsDisabled
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get global disabled status for AI features
      description: Get the <code>disabled</code> status for AI features for the deployment.
      responses:
        "200":
          description: Current global disabled status for AI features
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiDisabledResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /ai/settings/features/{feature}:
    get:
      operationId: getAiSettingsFeaturesByFeature
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get the enabled or disabled setting for an AI feature
      description: Get the enabled or disabled setting for the specified AI feature.
      responses:
        "200":
          description: Feature status
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiFeatureValueResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Unknown feature
        "500":
          description: Failed to read the feature
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: feature
          in: path
          required: true
          schema:
            type: string
          description: The AI feature to get the status for.
    post:
      operationId: createAiSettingsFeaturesByFeature
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Enable or disable an AI feature
      description: Enable or disable the specified AI feature.<br/><br/>Use <code>POST
        /ai/consent</code> to explicitly consent to use AI features for the
        deployment before using this endpoint to enable a specific AI feature.
      responses:
        "200":
          description: Updated feature status
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/BooleanRecord"
        "400":
          description: Request body must include a boolean <code>value</code>
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Unknown feature
        "500":
          description: Failed to persist the feature
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AiFeatureToggleRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AiFeatureToggleRequest"
            examples:
              UpdateAiFeatureExamplesEnableFeature:
                $ref: "#/components/examples/UpdateAiFeatureExamplesEnableFeature"
      parameters:
        - name: feature
          in: path
          required: true
          schema:
            type: string
          description: The AI feature to enable or disable.
  /ai/settings/features:
    get:
      operationId: getAiSettingsFeatures
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: List the enabled or disabled settings for all AI features
      description: Get a list of the enabled or disabled settings for all AI features.
      responses:
        "200":
          description: List of AI features and enabled or disabled settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiSettings"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Failed to load feature settings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createAiSettingsFeatures
      tags:
        - ai-settings
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update multiple AI feature flags
      description: Update the enabled and disabled settings for multiple AI settings
        in one request.<br/><br/>Use <code>POST /ai/consent</code> to explicitly
        consent to use AI features for the deployment before using this endpoint
        to enable a specific AI feature.
      responses:
        "200":
          description: Map of each updated feature key to its new state
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiSettings"
        "400":
          description: Invalid body, unknown features, non-boolean values, or partial
            update failures
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/AiFeaturesBulkPartialFailureResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Failed to persist one or more features (included in error payload
            when applicable)
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AiSettings object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AiSettings"
            examples:
              UpdateAiFeaturesBulkExamplesMultipleFeatures:
                $ref: "#/components/examples/UpdateAiFeaturesBulkExamplesMultipleFeatures"
  /ai/settings/mcp/servers/{id}:
    get:
      operationId: getAiSettingsMcpServersById
      tags:
        - ai-settings
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get one MCP external context server
      description: Get one configured MCP server without secret fields.
      responses:
        "200":
          description: List of MCPServerGetResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMcpServerGetResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The MCP server id.
  /ai/settings/mcp/servers:
    get:
      operationId: getAiSettingsMcpServers
      tags:
        - ai-settings
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List MCP external context servers
      description: List configured MCP servers without secret fields.
      responses:
        "200":
          description: List of MCPServersListResponse objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMcpServersListResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    put:
      operationId: updateAiSettingsMcpServers
      tags:
        - ai-settings
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Replace MCP external context servers
      description: Replace the full list of MCP servers. Request body must be an
        object with a servers array.
      responses:
        "200":
          description: The updated MCPServersListResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedMcpServersListResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: MCPServersPutRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/MCPServersPutRequest"
  /ai/consent:
    get:
      operationId: getAiConsent
      tags:
        - consent
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Get consent setting for AI features
      description: Get the current explicit consent setting for AI features. If
        <code>true</code>, consent to use AI features is granted for the
        deployment. If <code>false</code>, consent to use AI features is
        declined for the deployment.
      responses:
        "200":
          description: Current consent state
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ConsentListResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Failed to load consent state
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createAiConsent
      tags:
        - consent
      x-cribl-internal: false
      x-cribl-availability: both
      summary: Update consent setting for AI features
      description: Update the explicit consent setting for AI features. Consent is a
        single setting that accepts (<code>true</code>) or declines
        (<code>false</code>) the use of all Cribl Copilot capabilites for the
        deployment.
      responses:
        "200":
          description: Saved consent
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/ConsentListResponse"
        "400":
          description: Request body must include a boolean <code>accepted</code> property
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Failed to save consent
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AiConsentUpdateRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AiConsentUpdateRequest"
            examples:
              UpdateAiConsentExamplesAcceptAi:
                $ref: "#/components/examples/UpdateAiConsentExamplesAcceptAi"
              UpdateAiConsentExamplesDeclineAi:
                $ref: "#/components/examples/UpdateAiConsentExamplesDeclineAi"
  /system/dsd/available-log-sources:
    get:
      operationId: getSystemDsdAvailableLogSources
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List all discovered log sources (Cribl.Cloud only)
      description: Get a list of all log sources discovered in the latest Data Source
        Discovery (DSD) scan for the specified AWS account (Cribl.Cloud only).
      responses:
        "200":
          description: Merged scan rows and worker inputs
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdAvailableLogSourcesApiResponse"
              examples:
                DsdAvailableLogSourcesResponseExamplesMerged:
                  $ref: "#/components/examples/DsdAvailableLogSourcesResponseExamplesMerged"
        "400":
          description: Missing query params, cloud service is not AWS, invalid account ID
            format, or invalid limit
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "502":
          description: Failure listing inputs on Cribl Leader
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "503":
          description: Failed to read scan results from storage
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
      parameters:
        - name: cloud
          in: query
          required: true
          schema:
            type: string
          description: Cloud provider (such as <code>AWS</code>).
        - name: accountId
          in: query
          required: true
          schema:
            type: string
          description: Account ID
        - name: service
          in: query
          required: false
          schema:
            type: string
          description: The cloud service to limit the response to. Repeat or
            comma-separate for multiple values.
        - name: region
          in: query
          required: false
          schema:
            type: string
          description: The region to limit the response to. Repeat or comma-separate for
            multiple values.
        - name: limit
          in: query
          required: false
          schema:
            type: number
          description: Maximum number of items to return in each page of the response
            (default <code>1000</code>, maximum <code>5000</code>). Use with
            <code>cursor</code> to paginate the response into manageable
            batches.
        - name: cursor
          in: query
          required: false
          schema:
            type: string
          description: Opaque token for fetching the next page of results. Use the
            <code>nextCursor</code> value from the previous response. Supported
            only for <code>cloud=AWS</code>.
      x-speakeasy-pagination:
        type: cursor
        inputs:
          - name: cursor
            in: parameters
            type: cursor
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items[0].discoveredDestinations
          nextCursor: $.items[0].nextCursor
  /system/dsd/cfn/read-permissions:
    post:
      operationId: createSystemDsdCfnReadPermissions
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Generate CloudFormation template for Data Source Discovery read
        permissions (Cribl.Cloud only)
      description: Generate a CloudFormation template that provisions the IAM roles
        required for a Data Source Discovery (DSD) connection (Cribl.Cloud
        only). Send the connection id from registration; the leader loads the
        stored connection record and the STS external id from secure storage.
        For AWS Organizations, the template includes a StackSet for member
        account access.
      responses:
        "200":
          description: CloudFormation YAML template
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedString"
        "400":
          description: Invalid body or template generation failure
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Unknown connection id
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DsdCfnReadPermissionsRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DsdCfnReadPermissionsRequestBody"
            examples:
              DsdCfnReadPermissionsExamplesByConnectionId:
                $ref: "#/components/examples/DsdCfnReadPermissionsExamplesByConnectionId"
  /system/dsd/configure-inputs:
    post:
      operationId: createSystemDsdConfigureInputs
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Run Data Source Discovery configure-inputs orchestration (Cribl.Cloud
        only)
      description: Accepts canonical integration rows, runs the blocking Firehose
        batch-configure phase when needed, merges listener credentials into
        rows, generates the customer CloudFormation template (YAML), and
        enqueues the asynchronous S3 batch-configure job (Cribl.Cloud only).
        Large batches may take significant wall-clock time; use generous HTTP
        client timeouts. Gateways may surface <code>504 Gateway Timeout</code>
        when the blocking phase exceeds upstream limits.
      responses:
        "200":
          description: Integration rows, provisioning artifacts (CloudFormation YAML), job
            identifiers, resource suffix, optional warnings
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdConfigureInputsResponse"
              examples:
                DsdConfigureInputsResponseExamplesSuccess:
                  $ref: "#/components/examples/DsdConfigureInputsResponseExamplesSuccess"
        "400":
          description: Invalid body, worker group ineligible for DSD, or orchestration
            validation failure
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Missing permission to create Sources in the referenced Worker Group
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "500":
          description: Unexpected failure after request acceptance
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "504":
          description: Blocking Firehose batch phase exceeded allowed wait time or
            upstream timeout
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
      requestBody:
        description: DsdConfigureInputsRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DsdConfigureInputsRequestBody"
            examples:
              DsdConfigureInputsRequestExamplesMinimalCloudTrail:
                $ref: "#/components/examples/DsdConfigureInputsRequestExamplesMinimalCloudTrail"
              DsdConfigureInputsRequestExamplesWithPerRowUserParams:
                $ref: "#/components/examples/DsdConfigureInputsRequestExamplesWithPerRowUserPar\
                  ams"
  /system/dsd/connections/{connectionId}:
    delete:
      operationId: deleteSystemDsdConnectionsByConnectionId
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete a Data Source Discovery connection (Cribl.Cloud only)
      description: Delete the specified Data Source Discovery (DSD) connection
        (Cribl.Cloud only).
      responses:
        "200":
          description: Connection removed
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdConnectionWriteResponse"
              examples:
                DsdConnectionWriteResponseExamplesCreated:
                  $ref: "#/components/examples/DsdConnectionWriteResponseExamplesCreated"
        "400":
          description: Missing or invalid connection id
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Unknown connection id
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: connectionId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the connection to delete.
    patch:
      operationId: updateSystemDsdConnectionsByConnectionId
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update a Data Source Discovery connection (Cribl.Cloud only)
      description: Update the specified Data Source Discovery (DSD) connection
        (Cribl.Cloud only).
      responses:
        "200":
          description: Connection updated
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdConnectionWriteResponse"
        "400":
          description: Invalid body or validation failure
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Unknown connection id
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: UpdateDsdConnectionPayload object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateDsdConnectionPayload"
            examples:
              DsdUpdateConnectionExamplesAwsAccount:
                $ref: "#/components/examples/DsdUpdateConnectionExamplesAwsAccount"
              DsdUpdateConnectionExamplesAwsOrganization:
                $ref: "#/components/examples/DsdUpdateConnectionExamplesAwsOrganization"
      parameters:
        - name: connectionId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the connection to update.
  /system/dsd/configure-inputs/jobs/{jobId}:
    get:
      operationId: getSystemDsdConfigureInputsJobsByJobId
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get configure-inputs batch job progress and results (Cribl.Cloud only)
      description: Returns the persisted batch-configure job for a <code>jobId</code>
        from POST configure-inputs (<code>pullBatchConfigureJobId</code> or
        <code>pushBatchConfigureJobId</code>) (Cribl.Cloud only).
      responses:
        "200":
          description: Job document (partial results while running)
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdConfigureInputsJobGetResponse"
              examples:
                DsdConfigureInputsJobGetResponseExamplesInProgress:
                  $ref: "#/components/examples/DsdConfigureInputsJobGetResponseExamplesInProgress"
                DsdConfigureInputsJobGetResponseExamplesDone:
                  $ref: "#/components/examples/DsdConfigureInputsJobGetResponseExamplesDone"
        "400":
          description: Missing jobId
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Missing permission to read job for one or more Worker Groups
            referenced by job items
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "404":
          description: Unknown jobId
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: jobId
          in: path
          required: true
          schema:
            type: string
          description: required Job id from the POST
            <code>/system/dsd/configure-inputs</code> response.
  /system/dsd/connections:
    get:
      operationId: getSystemDsdConnections
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List all Data Source Discovery connections (Cribl.Cloud only)
      description: Get a list of all registered Data Source Discovery (DSD)
        connections (Cribl.Cloud only). The response matches persisted
        connection fields only; <code>stsExternalId</code> is never included.
        External IDs are stored server-side for scans and CloudFormation
        bootstrap flows.
      responses:
        "200":
          description: Registered connections
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdListConnectionsApiResponse"
              examples:
                DsdListConnectionsResponseExamplesSample:
                  $ref: "#/components/examples/DsdListConnectionsResponseExamplesSample"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
    post:
      operationId: createSystemDsdConnections
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Register a Data Source Discovery connection (Cribl.Cloud only)
      description: Register an AWS account or AWS Organization to use for Data Source
        Discovery (DSD) (Cribl.Cloud only).
      responses:
        "201":
          description: Connection created
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdConnectionWriteResponse"
              examples:
                DsdConnectionWriteResponseExamplesCreated:
                  $ref: "#/components/examples/DsdConnectionWriteResponseExamplesCreated"
        "400":
          description: Invalid body or validation failure
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "409":
          description: Connection already exists for the AWS account or AWS Organizations
            scope
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: RegisterDsdConnectionPayload object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/RegisterDsdConnectionPayload"
            examples:
              DsdRegisterConnectionExamplesAwsAccount:
                $ref: "#/components/examples/DsdRegisterConnectionExamplesAwsAccount"
              DsdRegisterConnectionExamplesAwsOrganization:
                $ref: "#/components/examples/DsdRegisterConnectionExamplesAwsOrganization"
  /system/dsd/org-inventory/scan:
    post:
      operationId: createSystemDsdOrgInventoryScan
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Start an account inventory scan for an AWS Organizations connection
        (Cribl.Cloud only)
      description: Start an inventory scan to discover member AWS accounts in an AWS
        Organization (Cribl.Cloud only). The request supplies only
        <code>connectionId</code>; the leader loads the STS External ID for that
        connection from secure storage before invoking the scanner.
      responses:
        "202":
          description: AWS Organizations inventory scan accepted
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdAsyncActionAcceptedResponse"
              examples:
                DsdAsyncAcceptedResponseExamplesScanStarted:
                  $ref: "#/components/examples/DsdAsyncAcceptedResponseExamplesScanStarted"
                DsdAsyncAcceptedResponseExamplesOrgInventoryStarted:
                  $ref: "#/components/examples/DsdAsyncAcceptedResponseExamplesOrgInventoryStarte\
                    d"
        "400":
          description: Invalid body or validation failure
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Data Source Discovery scanning is not available, or required
            connection trust material is missing from secure storage
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
      requestBody:
        description: DsdOrgInventoryScanRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DsdOrgInventoryScanRequestBody"
            examples:
              DsdOrgInventoryScanExamplesByConnectionId:
                $ref: "#/components/examples/DsdOrgInventoryScanExamplesByConnectionId"
  /system/dsd/scan:
    post:
      operationId: createSystemDsdScan
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Start a Data Source Discovery data scan (Cribl.Cloud only)
      description: Start a Data Source Discovery (DSD) scan for log sources in a
        directly-connected AWS account or connected AWS Organization member
        account (Cribl.Cloud only). The request body does not accept
        <code>stsExternalId</code>; the leader resolves the STS External ID for
        the matching connection from secure storage before invoking the scanner.
      responses:
        "202":
          description: Scan request accepted
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdAsyncActionAcceptedResponse"
              examples:
                DsdAsyncAcceptedResponseExamplesScanStarted:
                  $ref: "#/components/examples/DsdAsyncAcceptedResponseExamplesScanStarted"
                DsdAsyncAcceptedResponseExamplesOrgInventoryStarted:
                  $ref: "#/components/examples/DsdAsyncAcceptedResponseExamplesOrgInventoryStarte\
                    d"
        "400":
          description: Invalid body or validation failure
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "503":
          description: Data Source Discovery scanning is not available, or required
            connection trust material is missing from secure storage
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
      requestBody:
        description: DsdDataScanRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DsdDataScanRequestBody"
            examples:
              DsdDataScanExamplesMinimalAccountScan:
                $ref: "#/components/examples/DsdDataScanExamplesMinimalAccountScan"
              DsdDataScanExamplesWithRegionsAndServices:
                $ref: "#/components/examples/DsdDataScanExamplesWithRegionsAndServices"
  /system/dsd/status:
    get:
      operationId: getSystemDsdStatus
      tags:
        - data-source-discovery
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get Data Source Discovery scan status (Cribl.Cloud only)
      description: Get the status of the latest Data Source Discovery (DSD) scan for
        log sources for the specified AWS account (Cribl.Cloud only).
      responses:
        "200":
          description: Status for the latest run
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdGetScanStatusApiResponse"
              examples:
                DsdStatusResponseExamplesRunning:
                  $ref: "#/components/examples/DsdStatusResponseExamplesRunning"
                DsdStatusResponseExamplesFailed:
                  $ref: "#/components/examples/DsdStatusResponseExamplesFailed"
        "400":
          description: Missing query parameters or invalid account ID format
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
              examples:
                DsdErrorResponseExamplesBadRequest:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadRequest"
                DsdErrorResponseExamplesNotFound:
                  $ref: "#/components/examples/DsdErrorResponseExamplesNotFound"
                DsdErrorResponseExamplesConflict:
                  $ref: "#/components/examples/DsdErrorResponseExamplesConflict"
                DsdErrorResponseExamplesBadGateway:
                  $ref: "#/components/examples/DsdErrorResponseExamplesBadGateway"
                DsdErrorResponseExamplesServiceUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesServiceUnavailable"
                DsdErrorResponseExamplesExternalIdMissing:
                  $ref: "#/components/examples/DsdErrorResponseExamplesExternalIdMissing"
                DsdErrorResponseExamplesForbidden:
                  $ref: "#/components/examples/DsdErrorResponseExamplesForbidden"
                DsdErrorResponseExamplesLoggingDestinationsUnavailable:
                  $ref: "#/components/examples/DsdErrorResponseExamplesLoggingDestinationsUnavail\
                    able"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: No scan status for the cloud provider and AWS account (empty
            response body)
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedDsdErrorBody"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: cloud
          in: query
          required: true
          schema:
            type: string
          description: Cloud provider (such as <code>AWS</code>).
        - name: accountId
          in: query
          required: true
          schema:
            type: string
          description: Account ID
  /products/lake/lakes/{lakeId}/sources:
    post:
      operationId: createProductsLakeLakesSourcesByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.sources
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Create a Lake Source (Cribl.Cloud only)
      description: Create a new Lake Source in the specified Lake (Cribl.Cloud only).
      responses:
        "200":
          description: The created CriblLakeSource object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeSource"
        "400":
          description: Missing or invalid sourceType
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Insufficient license
        "500":
          description: Internal error while creating source
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeSource object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeSource"
            examples:
              LakeSourceCreateExamplesDdssSource:
                $ref: "#/components/examples/LakeSourceCreateExamplesDdssSource"
              LakeSourceCreateExamplesHttpSource:
                $ref: "#/components/examples/LakeSourceCreateExamplesHttpSource"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake to create the Lake Source in.
    get:
      operationId: getProductsLakeLakesSourcesByLakeId
      tags:
        - lake
      x-speakeasy-group: lakes.sources
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List all Lake Sources (Cribl.Cloud only)
      description: Get a list of all Lake Sources in the specified Lake (Cribl.Cloud only).
      responses:
        "200":
          description: List of CriblLakeSource objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeSource"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Insufficient license
        "500":
          description: Failed to fetch sources
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Lake Sources.
  /products/lake/lakes/{lakeId}/sources/{id}:
    delete:
      operationId: deleteProductsLakeLakesSourcesByLakeIdAndId
      tags:
        - lake
      x-speakeasy-group: lakes.sources
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete a Lake Source (Cribl.Cloud only)
      description: Delete the specified Lake Source in the specified Lake (Cribl.Cloud
        only).
      responses:
        "200":
          description: The deleted CriblLakeSource object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeSource"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Insufficient license
        "500":
          description: Internal error while deleting source
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Lake Source to
            delete.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake Source to delete.
    get:
      operationId: getProductsLakeLakesSourcesByLakeIdAndId
      tags:
        - lake
      x-speakeasy-group: lakes.sources
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get a Lake Source (Cribl.Cloud only)
      description: Get the specified Lake Source in the specified Lake (Cribl.Cloud only).
      responses:
        "200":
          description: List of CriblLakeSource objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeSource"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Insufficient license
        "500":
          description: Failed to fetch sources
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Lake Source.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake Source to get.
    patch:
      operationId: updateProductsLakeLakesSourcesByLakeIdAndId
      tags:
        - lake
      x-speakeasy-group: lakes.sources
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update a Lake Source (Cribl.Cloud only)
      description: Update the specified Lake Source in the specified Lake (Cribl.Cloud
        only).
      responses:
        "200":
          description: The updated CriblLakeSource object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedCriblLakeSource"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Insufficient license
        "500":
          description: Internal error while updating source
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: CriblLakeSource object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/CriblLakeSource"
            examples:
              LakeSourceUpdateExamplesUpdateDdssSource:
                $ref: "#/components/examples/LakeSourceUpdateExamplesUpdateDdssSource"
              LakeSourceUpdateExamplesUpdateHttpSource:
                $ref: "#/components/examples/LakeSourceUpdateExamplesUpdateHttpSource"
      parameters:
        - name: lakeId
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake that contains the Lake Source to
            update.
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Lake Source to update.
  /search/event-breaker-preview:
    post:
      operationId: createSearchEventBreakerPreview
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Preview Event Breaker output (Cribl.Cloud only)
      description: Preview the Event Breaker rule against the supplied input and
        return split events with processing timing (Cribl.Cloud only).
      responses:
        "200":
          description: The requested preview object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/PreviewResponseBody"
              examples:
                DatatypePreviewResponseExamplesWithEvents:
                  $ref: "#/components/examples/DatatypePreviewResponseExamplesWithEvents"
                DatatypePreviewResponseExamplesNoEvents:
                  $ref: "#/components/examples/DatatypePreviewResponseExamplesNoEvents"
        "400":
          description: Invalid request body or schema validation failure.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "429":
          description: Search limit exceeded for preview.
        "500":
          description: Preview processing failed.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: DatatypePreviewRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DatatypePreviewRequestBody"
            examples:
              DatatypePreviewRequestExampleDatasetWithRegexBreaker:
                $ref: "#/components/examples/DatatypePreviewRequestExampleDatasetWithRegexBreak\
                  er"
              DatatypePreviewRequestExampleDatasetDefaultBreakers:
                $ref: "#/components/examples/DatatypePreviewRequestExampleDatasetDefaultBreaker\
                  s"
  /search/docs:
    get:
      operationId: getSearchDocs
      tags:
        - search
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get Search documentation (Cribl.Cloud only)
      description: Get Search documentation (Cribl.Cloud only).
      responses:
        "200":
          description: The requested KustoDocs object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/KustoDocs"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/healthcheck:
    get:
      operationId: getSearchHealthcheck
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Get health check metric for search (Cribl.Cloud only).
      description: Get health check metric for search (Cribl.Cloud only).
      security: []
      responses:
        "200":
          description: List of SearchHealthCheckStatus objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchHealthCheckStatus"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/jobs/{id}/diag:
    get:
      operationId: getSearchJobsDiagById
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Download a diagnostic bundle for a search job (Cribl.Cloud only)
      description: Download a diagnostic bundle (tar (Cribl.Cloud only).gz archive)
        for the specified search job.
      responses:
        "200":
          content:
            application/x-tgz:
              schema:
                type: string
                format: binary
          description: Gzip-compressed tar archive of job diagnostic data.
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job.
        - name: includeResults
          in: query
          required: false
          schema:
            type: boolean
          description: If omitted, defaults to <code>true</code>. If <code>false</code>,
            omits search result data from the diagnostic archive.
  /search/jobs/{id}/logs/{filename}:
    get:
      operationId: getSearchJobsLogsByIdAndFilename
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Download a log file for a search job (Cribl.Cloud only)
      description: Download the contents of a specific log file for the specified
        search job (Cribl.Cloud only). Most log files are Newline Delimited JSON
        (NDJSON). The <code>explain.log</code> file is plain text (ClickHouse
        EXPLAIN output).
      responses:
        "200":
          description: The requested string object.
          content:
            application/x-ndjson:
              schema:
                type: string
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Log file not found for this search job.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job.
        - name: filename
          in: path
          required: true
          schema:
            type: string
          description: The name of the log file.
  /search/jobs/{id}/results:
    get:
      operationId: getSearchJobsResultsById
      tags:
        - search
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List Paginated Search Results (Cribl.Cloud only)
      description: List search results, when lower/upper bound is provided, offset is
        relative to the time range (Cribl.Cloud only).
      responses:
        "200":
          description: The requested SearchJobResults object.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/SearchJobResults"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: search job id
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: maximum number of events returned
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: starting offset of the events
        - name: lowerBound
          in: query
          required: false
          schema:
            type: number
          description: lower bound of the time range, inclusive
        - name: upperBound
          in: query
          required: false
          schema:
            type: number
          description: upper bound of the time range, exclusive
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /search/jobs/{id}/results-poll:
    get:
      operationId: getSearchJobsResultsPollById
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: List Search Results (Cribl.Cloud only)
      description: List search results (Cribl.Cloud only).
      responses:
        "200":
          description: The requested SearchJobResults object.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/SearchJobResults"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: search job id
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: maximum number of events returned
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: starting offset of the events
        - name: lowerBound
          in: query
          required: false
          schema:
            type: number
          description: lower bound of the time range, inclusive
        - name: upperBound
          in: query
          required: false
          schema:
            type: number
          description: upper bound of the time range, exclusive
        - name: lastJobStatus
          in: query
          required: false
          schema:
            type: string
            enum:
              - queued
            x-speakeasy-unknown-values: allow
          description: last known status of the Search Job. Used to return immediately
            upon status change if the status was queued.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /search/jobs/{id}/metrics:
    get:
      operationId: getSearchJobsMetricsById
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Get metrics for a search job (Cribl.Cloud only)
      description: Get performance and execution metrics for the specified search job
        (Cribl.Cloud only).
      responses:
        "200":
          description: The metrics object for the search job in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMetrics"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Metrics for the specified search job were not found.
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the search job
  /search/job-metrics:
    get:
      operationId: getSearchJobMetrics
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: List metrics for all search jobs (Cribl.Cloud only)
      description: Get a list of performance and execution metrics for all search jobs
        (Cribl.Cloud only).
      responses:
        "200":
          description: List of metrics objects for all search jobs.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchMetric"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/lake-destinations:
    get:
      operationId: getSearchLakeDestinations
      tags:
        - search
      x-speakeasy-group: search.lakeDestinations
      x-speakeasy-name-override: list
      x-cribl-internal: true
      x-cribl-availability: both
      summary: List Data Lake Amazon S3 Destinations
      description: Get a list of the Data Lake Amazon S3 Destinations (type
        <code>dl_s3</code>) that are available to use with Cribl Search Dataset
        Providers.
      responses:
        "200":
          description: List of Data Lake Amazon S3 Destination configurations.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchLakeDestination"
              examples:
                SearchLakeDestinationsListExamplesDataLakeS3:
                  $ref: "#/components/examples/SearchLakeDestinationsListExamplesDataLakeS3"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of Data Lake Amazon S3 Destinations to return in the
            response for this request. Use with <code>offset</code> to paginate
            the response into manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /search/notifications:
    post:
      operationId: createSearchNotifications
      tags:
        - searchNotifications
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Forward a search Notification (Cribl.Cloud only)
      description: Forward a search Notification to the Notification server for
        delivery to configured Notification targets (Cribl.Cloud only). The
        <code>POST /search/notifications</code> endpoint is called internally by
        scheduled search jobs when their results match the triggering conditions
        for a Notification.
      responses:
        "200":
          description: The created SearchNotificationResponse object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSearchNotificationResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: SearchNotification object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/SearchNotification"
            examples:
              CreateSearchNotificationExamplesScheduledSearchNotify:
                $ref: "#/components/examples/CreateSearchNotificationExamplesScheduledSearchNot\
                  ify"
              CreateSearchNotificationExamplesWithResultSet:
                $ref: "#/components/examples/CreateSearchNotificationExamplesWithResultSet"
  /search/preview:
    post:
      operationId: createSearchPreview
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Preview a Search query (Cribl.Cloud only)
      description: Apply a query snippet to a set of input events to preview the
        results (Cribl.Cloud only).
      responses:
        "200":
          description: The created PreviewResponseBody object in a single-item list.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedPreviewResponseBody"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: PreviewRequestBody object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/PreviewRequestBody"
            examples:
              SearchPreviewRequestExamplesMinimal:
                $ref: "#/components/examples/SearchPreviewRequestExamplesMinimal"
              SearchPreviewRequestExamplesWithTimeBounds:
                $ref: "#/components/examples/SearchPreviewRequestExamplesWithTimeBounds"
  /search/query:
    get:
      operationId: getSearchQuery
      tags:
        - query
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Run a Search Query (Cribl.Cloud only)
      description: Runs the query and returns the results (Cribl.Cloud only).
      responses:
        "200":
          description: The requested SearchJobResults object.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/SearchJobResults"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: queryId
          in: query
          required: false
          schema:
            type: string
          description: Saved query ID
        - name: jobId
          in: query
          required: false
          schema:
            type: string
          description: Job ID
        - name: query
          in: query
          required: false
          schema:
            type: string
          description: Search query string
        - name: earliest
          in: query
          required: false
          schema:
            type:
              - string
              - number
          description: Beginning of query time range, inclusive, in a relative time format
            or seconds
        - name: latest
          in: query
          required: false
          schema:
            type:
              - string
              - number
          description: End of query time range, exclusive, in a relative time format or
            seconds
        - name: sampleRate
          in: query
          required: false
          schema:
            type: number
          description: Number between 0-1 to sample events during search
        - name: force
          in: query
          required: false
          schema:
            type: boolean
          description: When true, forces to run the scheduled query
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Pagination offset
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Pagination limit - maximum number of events to return
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /search/ui-metrics:
    post:
      operationId: createSearchUiMetrics
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Send UI metrics (Cribl.Cloud only)
      description: Send metric events from the UI endpoint (Cribl.Cloud only).
      responses:
        "200":
          description: The created string object.
          content:
            application/json:
              schema:
                type: string
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/vpc-endpoint-ids:
    get:
      operationId: getSearchVpcEndpointIds
      tags:
        - search
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: List S3 interface VPC endpoint IDs (Cribl.Cloud only)
      description: List S3 interface VPC endpoint IDs for AWS regions where Cribl
        Search runs (Cribl.Cloud only). Use these values when configuring
        attribute-based access control (ABAC) tags in IAM trust and permission
        policies.
      responses:
        "200":
          description: S3 VPC endpoint identifiers
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/SearchVpcEndpointIdsSchema"
              examples:
                SearchVpcEndpointIdsListExamplesMultipleRegions:
                  $ref: "#/components/examples/SearchVpcEndpointIdsListExamplesMultipleRegions"
                SearchVpcEndpointIdsListExamplesSingleRegion:
                  $ref: "#/components/examples/SearchVpcEndpointIdsListExamplesSingleRegion"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/trust-policies:
    get:
      operationId: getSearchTrustPolicies
      tags:
        - trust-policies
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: List IAM trust policies for Search (Cribl.Cloud only)
      description: Get a list of all trust policies for establishing cross-account
        trust relationships (Cribl.Cloud only).
      responses:
        "200":
          description: List of TrustPolicy objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedTrustPolicy"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: groupId
          in: query
          required: false
          schema:
            type: string
          description: Worker group for the trust policy.
  /search/datasets/{id}/data:
    delete:
      operationId: deleteSearchDatasetsDataById
      tags:
        - datasets
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Remove ingested events from a Cribl Search Dataset (Cribl.Cloud only)
      description: Remove all ingested events from the specified Cribl Search Dataset
        (Cribl.Cloud only).
      responses:
        "204":
          description: No Content on success
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Cribl Search Dataset to remove ingested
            events from.
  /search/datasets/{id}/favorites:
    post:
      operationId: createSearchDatasetsFavoritesById
      tags:
        - datasets
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Add a Dataset favorite (Cribl.Cloud only)
      description: Add a favorite for a dataset (Cribl.Cloud only).
      responses:
        "200":
          description: The created DatasetFavoritesResponse object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DatasetFavoritesResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The dataset ID
    get:
      operationId: getSearchDatasetsFavoritesById
      tags:
        - datasets
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: List Dataset favorites (Cribl.Cloud only)
      description: Get all favorites for a dataset (Cribl.Cloud only).
      responses:
        "200":
          description: The requested DatasetFavoritesResponse object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DatasetFavoritesResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The dataset ID
    delete:
      operationId: deleteSearchDatasetsFavoritesById
      tags:
        - datasets
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Remove a Dataset favorite (Cribl.Cloud only)
      description: Remove a favorite for a dataset (Cribl.Cloud only).
      responses:
        "200":
          description: The deleted DatasetFavoritesResponse object.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DatasetFavoritesResponse"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The dataset ID
  /search/datasets/{id}/datasetStats:
    get:
      operationId: getSearchDatasetsDatasetStatsById
      tags:
        - datasets
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Get lakehouse engine Dataset statistics (Cribl.Cloud only)
      description: Get aggregated event and byte count statistics for a lakehouse
        engine Dataset (Cribl.Cloud only).
      responses:
        "200":
          description: Totals and per-bucket time series for event counts and bytes.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DatasetStatsResponse"
              examples:
                DatasetStatsExamplesOneDayHourly:
                  $ref: "#/components/examples/DatasetStatsExamplesOneDayHourly"
        "400":
          description: Invalid query parameters or JSON-schema validation failure.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RestApiJsonError"
              examples:
                DatasetStatsError400ExamplesInvalidQueryParams:
                  $ref: "#/components/examples/DatasetStatsError400ExamplesInvalidQueryParams"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Dataset not found or not a lakehouse engine Dataset.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RestApiJsonError"
              examples:
                DatasetStatsError404ExamplesDatasetNotFound:
                  $ref: "#/components/examples/DatasetStatsError404ExamplesDatasetNotFound"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset to get statistics for.
        - name: startTime
          in: query
          required: true
          schema:
            type: number
          description: Window start timestamp (in Unix time) in milliseconds. Must be a
            non-negative integer.
        - name: endTime
          in: query
          required: true
          schema:
            type: integer
          description: Window end timestamp (in Unix time) in milliseconds. Must be later
            than the specified <code>startTime</code>.
        - name: granularity
          in: query
          required: true
          schema:
            type: integer
          description: Bucket width for the time series, in milliseconds. Must be less
            than the specified time window (<code>endTime</code> -
            <code>startTime</code>). Values of 1 hour or more must be an exact
            multiple of 1 hour in milliseconds.
  /search/datasets/{id}/usageStats:
    get:
      operationId: getSearchDatasetsUsageStatsById
      tags:
        - datasets
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Get lakehouse engine Dataset query usage statistics (Cribl.Cloud only)
      description: Get query usage statistics for a lakehouse engine Dataset
        (Cribl.Cloud only).
      responses:
        "200":
          description: Query counts by type over time, top users, and optional
            lastQueryTime.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/DatasetUsageStatsResponse"
              examples:
                DatasetUsageStatsExamplesLast24Hours:
                  $ref: "#/components/examples/DatasetUsageStatsExamplesLast24Hours"
        "400":
          description: Invalid endTime, timeWindow, or granularity (out of range or not a
            multiple of 1 whole minute).
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RestApiJsonError"
              examples:
                DatasetUsageStatsError400ExamplesInvalidParams:
                  $ref: "#/components/examples/DatasetUsageStatsError400ExamplesInvalidParams"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset to get usage statistics for.
        - name: endTime
          in: query
          required: false
          schema:
            type: integer
          description: Window end timestamp (in Unix time) in milliseconds. Defaults to
            the current server time. Must not be older than 365 days.
        - name: timeWindow
          in: query
          required: false
          schema:
            type: integer
          description: Duration of the time window in milliseconds, counted back from the
            specified <code>endTime</code>. Defaults to <code>86400000</code>
            (24 hours). Must be a multiple of 1 minute and must not exceed 30
            days.
        - name: granularity
          in: query
          required: false
          schema:
            type: integer
          description: Bucket width in milliseconds. Must be a multiple of 1 minute and
            must not exceed 24 hours.
  /search/datasets/{id}/fieldStats:
    get:
      operationId: getSearchDatasetsFieldStatsById
      tags:
        - datasets
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Get lakehouse engine Dataset field statistics (Cribl.Cloud only)
      description: Get field-level statistics for a lakehouse engine Dataset
        (Cribl.Cloud only).
      responses:
        "200":
          description: Total events in range and an array of field-level statistics.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/FieldStatsResponse"
              examples:
                FieldStatsExamplesMixedFields:
                  $ref: "#/components/examples/FieldStatsExamplesMixedFields"
        "400":
          description: Invalid query parameters or JSON-schema validation failure.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RestApiJsonError"
              examples:
                FieldStatsError400ExamplesInvalidQueryParams:
                  $ref: "#/components/examples/FieldStatsError400ExamplesInvalidQueryParams"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Dataset not found or not a lakehouse engine Dataset.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/RestApiJsonError"
              examples:
                DatasetStatsError404ExamplesDatasetNotFound:
                  $ref: "#/components/examples/DatasetStatsError404ExamplesDatasetNotFound"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Dataset to get field statistics for.
        - name: startTime
          in: query
          required: true
          schema:
            type: integer
          description: Window start timestamp (in Unix time) in milliseconds. Must be a
            non-negative integer.
        - name: endTime
          in: query
          required: true
          schema:
            type: integer
          description: Window end timestamp (in Unix time) in milliseconds. Must be later
            than the specified <code>startTime</code>.
        - name: granularity
          in: query
          required: true
          schema:
            type: integer
          description: Bucket width for the time series, in milliseconds. Must be less
            than the specified time window (<code>endTime</code> -
            <code>startTime</code>). Values of 1 hour or more must be an exact
            multiple of 1 hour in milliseconds.
  /search/local_search/deploy:
    patch:
      operationId: updateSearchLocalSearchDeploy
      tags:
        - search
      x-speakeasy-group: searches.localSearches
      x-speakeasy-name-override: deploy
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Deploy lakehouse service configuration (Cribl.Cloud only)
      description: Deploy the current lakehouse configuration to workers (Cribl.Cloud only).
      responses:
        "200":
          description: Deployment metadata for the lakehouse configuration
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedConfigGroup"
              examples:
                LocalSearchDeployExamplesDeployedWorkerGroup:
                  $ref: "#/components/examples/LocalSearchDeployExamplesDeployedWorkerGroup"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Lakehouse service is not enabled or is not configured
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchApiErrorBody"
        "500":
          description: Unexpected error while deploying lakehouse configuration
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchApiErrorBody"
  /search/local_search:
    get:
      operationId: getSearchLocalSearch
      tags:
        - search
      x-speakeasy-group: searches.localSearches
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get lakehouse service status (Cribl.Cloud only)
      description: Get the lakehouse service status, including whether it is enabled,
        the estimated ingest rate, and a list of active lakehouse engines
        (Cribl.Cloud only).
      responses:
        "200":
          description: Paginated list items describing lakehouse service status
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchStatus"
              examples:
                LocalSearchGetStatusExamplesWithEngines:
                  $ref: "#/components/examples/LocalSearchGetStatusExamplesWithEngines"
                LocalSearchGetStatusExamplesNoEngines:
                  $ref: "#/components/examples/LocalSearchGetStatusExamplesNoEngines"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "404":
          description: Lakehouse service is not enabled or is not configured.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchApiErrorBody"
        "500":
          description: Unexpected error while loading lakehouse service status
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchApiErrorBody"
      parameters:
        - name: offset
          in: query
          required: false
          schema:
            type: integer
          description: Starting point from which to retrieve results for this request. Use
            with <code>limit</code> to paginate the response into manageable
            batches.
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum number of lakehouse service status items to return in the
            response for this request. Use with <code>offset</code> to paginate
            the response into manageable batches.
      x-speakeasy-pagination:
        type: offsetLimit
        inputs:
          - name: offset
            in: parameters
            type: offset
          - name: limit
            in: parameters
            type: limit
        outputs:
          results: $.items
  /search/local_search/config:
    get:
      operationId: getSearchLocalSearchConfig
      tags:
        - search
      x-speakeasy-group: searches.localSearches.configs
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get operator-only lakehouse service infrastructure sync payload
        (Cribl.Cloud only)
      description: Get lakehouse service worker sizing and per-engine storage and
        compute tier size for infrastructure orchestration (Cribl.Cloud
        only).<br/><br/>Requires the <code>cribl_operator</code> role.
      responses:
        "200":
          description: Worker and storage entries for infrastructure synchronization
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LocalSearchInfraSyncPayload"
              examples:
                LocalSearchInfraSyncExamplesActiveEngines:
                  $ref: "#/components/examples/LocalSearchInfraSyncExamplesActiveEngines"
                LocalSearchInfraSyncExamplesClearInfrastructure:
                  $ref: "#/components/examples/LocalSearchInfraSyncExamplesClearInfrastructure"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "403":
          description: Requires the <code>cribl_operator</code> role (no response body)
        "500":
          description: Unexpected error while building the infrastructure sync payload
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchApiErrorBody"
  /search/local_search/capture:
    post:
      operationId: createSearchLocalSearchCapture
      tags:
        - search
      x-speakeasy-group: searches.localSearches.captures
      x-speakeasy-name-override: start
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Start a Local Search capture (Cribl.Cloud only)
      description: Streams captured events from Local Search as NDJSON after applying
        draft rulesets at the requested capture level (Cribl.Cloud only).
      responses:
        "200":
          description: Captured events as NDJSON lines
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/CapturedEvent"
              examples:
                LocalSearchCaptureNdjsonResponseExamplesSampleEventLine:
                  $ref: "#/components/examples/LocalSearchCaptureNdjsonResponseExamplesSampleEven\
                    tLine"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "429":
          description: Maximum concurrent captures are in progress; try again later.
          content:
            application/x-ndjson:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchApiErrorBody"
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LocalSearchCaptureParams object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LocalSearchCaptureParams"
            examples:
              LocalSearchCaptureExamplesAtSource:
                $ref: "#/components/examples/LocalSearchCaptureExamplesAtSource"
              LocalSearchCaptureExamplesAfterDatatyping:
                $ref: "#/components/examples/LocalSearchCaptureExamplesAfterDatatyping"
              LocalSearchCaptureExamplesAfterDatasetDetection:
                $ref: "#/components/examples/LocalSearchCaptureExamplesAfterDatasetDetection"
  /search/local_search/capture/stop:
    post:
      operationId: createSearchLocalSearchCaptureStop
      tags:
        - search
      x-speakeasy-group: searches.localSearches.captures
      x-speakeasy-name-override: stop
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Stop a Local Search capture (Cribl.Cloud only)
      description: Stops a capture request given the matching session with the
        provided <code>captureId</code> (Cribl.Cloud only).
      responses:
        "204":
          description: No response body
          content:
            application/json:
              schema:
                type: object
                additionalProperties: true
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LocalSearchCaptureStopRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LocalSearchCaptureStopRequest"
            examples:
              LocalSearchCaptureStopExamplesById:
                $ref: "#/components/examples/LocalSearchCaptureStopExamplesById"
  /search/local_search/source-docs/{sourceType}:
    get:
      operationId: getSearchLocalSearchSourceDocsBySourceType
      tags:
        - search
      x-speakeasy-group: searches.localSearches.sourceDocs
      x-speakeasy-name-override: get
      x-cribl-internal: true
      x-cribl-availability: cloud
      summary: Get Local Search source documentation (Cribl.Cloud only)
      description: Gets structured documentation content for the specified Local
        Search source type (Cribl.Cloud only). This endpoint supports rendering
        the Documentation tab in the Local Search source editor and only returns
        content from Cribl Docs pages mapped to supported Local Search source
        types.
      responses:
        "200":
          description: Structured Local Search source documentation content
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LocalSearchSourceDocs"
        "400":
          description: The Local Search source type is not supported.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LocalSearchApiErrorBody"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
        "502":
          description: The public Cribl Docs page could not be fetched or parsed.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/LocalSearchApiErrorBody"
      parameters:
        - name: sourceType
          in: path
          required: true
          schema:
            $ref: "#/components/schemas/SupportedLocalSearchSourceType"
          description: The Local Search source type whose documentation content to get.
  /search/local_search/sources/{id}/hectoken:
    post:
      operationId: createSearchLocalSearchSourcesHecTokenById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.sources.hecTokens
      x-speakeasy-name-override: addSourceHecToken
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Add an HEC token to a Splunk HEC Local Search source (Cribl.Cloud only)
      description: Adds an HEC token with optional metadata to an existing
        <code>splunk_hec</code> Local Search source (Cribl.Cloud only).
      responses:
        "200":
          description: Updated Splunk HEC source configurations
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchSource"
              examples:
                LocalSearchSourceCountedResponseExamplesSingleSource:
                  $ref: "#/components/examples/LocalSearchSourceCountedResponseExamplesSingleSour\
                    ce"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: AddHecTokenRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/AddHecTokenRequest"
            examples:
              HecTokenExamplesHecToken:
                $ref: "#/components/examples/HecTokenExamplesHecToken"
              HecTokenExamplesHecTokenWithIndexAccess:
                $ref: "#/components/examples/HecTokenExamplesHecTokenWithIndexAccess"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Splunk HEC Local Search source receiving
            this token.
  /search/local_search/sources:
    post:
      operationId: createSearchLocalSearchSources
      tags:
        - search
      x-speakeasy-group: searches.localSearches.sources
      x-speakeasy-name-override: create
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Create a Local Search source (Cribl.Cloud only)
      description: Creates a source on Local Search using a supported type; bind
        address and several per-type defaults are enforced server-side
        (Cribl.Cloud only).
      responses:
        "200":
          description: The created Local Search source configurations
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchSource"
              examples:
                LocalSearchSourceCountedResponseExamplesSingleSource:
                  $ref: "#/components/examples/LocalSearchSourceCountedResponseExamplesSingleSour\
                    ce"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LocalSearchSource object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LocalSearchSource"
            examples:
              LocalSearchSourceCreateExamplesCriblHttp:
                $ref: "#/components/examples/LocalSearchSourceCreateExamplesCriblHttp"
              LocalSearchSourceCreateExamplesCriblHttpWithDescription:
                $ref: "#/components/examples/LocalSearchSourceCreateExamplesCriblHttpWithDescri\
                  ption"
              LocalSearchSourceCreateExamplesSplunkHec:
                $ref: "#/components/examples/LocalSearchSourceCreateExamplesSplunkHec"
              LocalSearchSourceCreateExamplesSyslogTcp:
                $ref: "#/components/examples/LocalSearchSourceCreateExamplesSyslogTcp"
    get:
      operationId: getSearchLocalSearchSources
      tags:
        - search
      x-speakeasy-group: searches.localSearches.sources
      x-speakeasy-name-override: list
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: List Local Search sources (Cribl.Cloud only)
      description: Returns supported Local Search sources configured, including
        connection endpoints and health metadata when available (Cribl.Cloud
        only).
      responses:
        "200":
          description: Paginated Local Search source configurations
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchSource"
              examples:
                LocalSearchSourceCountedResponseExamplesSingleSource:
                  $ref: "#/components/examples/LocalSearchSourceCountedResponseExamplesSingleSour\
                    ce"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /search/local_search/sources/{id}:
    delete:
      operationId: deleteSearchLocalSearchSourcesById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.sources
      x-speakeasy-name-override: delete
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Delete a Local Search source (Cribl.Cloud only)
      description: Deletes the specified source when it exists (Cribl.Cloud only).
      responses:
        "200":
          description: The sources returned after deletion
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchSource"
              examples:
                LocalSearchSourceCountedResponseExamplesSingleSource:
                  $ref: "#/components/examples/LocalSearchSourceCountedResponseExamplesSingleSour\
                    ce"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Local Search source to delete.
    get:
      operationId: getSearchLocalSearchSourcesById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.sources
      x-speakeasy-name-override: get
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Get a Local Search source (Cribl.Cloud only)
      description: Returns the specified Local Search source when it exists and uses a
        supported source type (Cribl.Cloud only).
      responses:
        "200":
          description: The requested Local Search source in a single-item list
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchSource"
              examples:
                LocalSearchSourceCountedResponseExamplesSingleSource:
                  $ref: "#/components/examples/LocalSearchSourceCountedResponseExamplesSingleSour\
                    ce"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Local Search source to get.
    patch:
      operationId: updateSearchLocalSearchSourcesById
      tags:
        - search
      x-speakeasy-group: searches.localSearches.sources
      x-speakeasy-name-override: update
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update a Local Search source (Cribl.Cloud only)
      description: Updates an existing supported Local Search source (Cribl.Cloud only).
      responses:
        "200":
          description: The updated Local Search source configurations
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchSource"
              examples:
                LocalSearchSourceCountedResponseExamplesSingleSource:
                  $ref: "#/components/examples/LocalSearchSourceCountedResponseExamplesSingleSour\
                    ce"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: LocalSearchSource object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/LocalSearchSource"
            examples:
              LocalSearchSourceUpdateExamplesCriblHttp:
                $ref: "#/components/examples/LocalSearchSourceUpdateExamplesCriblHttp"
              LocalSearchSourceUpdateExamplesSplunkHec:
                $ref: "#/components/examples/LocalSearchSourceUpdateExamplesSplunkHec"
              LocalSearchSourceUpdateExamplesSyslogTcp:
                $ref: "#/components/examples/LocalSearchSourceUpdateExamplesSyslogTcp"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Local Search source to update.
  /search/local_search/sources/{id}/hectoken/{token}:
    patch:
      operationId: updateSearchLocalSearchSourcesHecTokenByIdAndToken
      tags:
        - search
      x-speakeasy-group: searches.localSearches.sources.hecTokens
      x-speakeasy-name-override: updateSourceHecToken
      x-cribl-internal: false
      x-cribl-availability: cloud
      summary: Update an HEC token on a Splunk HEC Local Search source (Cribl.Cloud
        only)
      description: Updates metadata or enabled state for an existing HEC token on a
        <code>splunk_hec</code> Local Search source (Cribl.Cloud only).
      responses:
        "200":
          description: Updated Splunk HEC source configurations
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedLocalSearchSource"
              examples:
                LocalSearchSourceCountedResponseExamplesSingleSource:
                  $ref: "#/components/examples/LocalSearchSourceCountedResponseExamplesSingleSour\
                    ce"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
      requestBody:
        description: UpdateHecTokenRequest object.
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/UpdateHecTokenRequest"
            examples:
              HecTokenExamplesHecToken:
                $ref: "#/components/examples/HecTokenExamplesHecToken"
              HecTokenExamplesHecTokenWithIndexAccess:
                $ref: "#/components/examples/HecTokenExamplesHecTokenWithIndexAccess"
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: string
          description: The <code>id</code> of the Splunk HEC Local Search source that owns
            this token.
        - name: token
          in: path
          required: true
          schema:
            type: string
          description: The existing HEC token string to update on the Splunk HEC source.
  /system-insights/healthcheck:
    get:
      operationId: getSystemInsightsHealthcheck
      tags:
        - system-insights
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get System Insights Health
      description: Get health check metric for system insights.
      security: []
      responses:
        "200":
          description: List of SystemInsightsHealthCheckStatus objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedSystemInsightsHealthCheckStatus"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
  /system-insights/ttl:
    get:
      operationId: getSystemInsightsTtl
      tags:
        - system-insights
      x-cribl-internal: true
      x-cribl-availability: both
      summary: Get System Insights TTL
      description: Get the current TTL for the System Insights database.
      responses:
        "200":
          description: List of number objects.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/CountedNumber"
        "401":
          description: Authentication failed (missing or invalid credentials or Bearer
            token).
        "500":
          description: Unexpected server error.
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Error"
