{"openapi":"3.1.0","info":{"title":"Splunk Observability Alerts (BYOK) API","version":"0.1.0","description":"Splunk Observability Alerts (BYOK) lets an AI assistant read your own Splunk Observability Alerts data through the Splunk Observability Alerts API with a key you supply (Splunk Observability Cloud user API access token). Read-only: 8 tools (list_detectors, get_detector, list_detector_events, list_detector_incidents, list_incidents, get_incident, list_muting_rules, get_muting_rule). The BYOK key...\n\nEvery operation is read-only or compute-only. The same tools are available over MCP (streamable HTTP) at https://byok-splunk-observability-alerts.connectorbay.com/mcp.","contact":{"name":"Unify Dynamics LLC","email":"agent@connectorbay.com","url":"https://connectorbay.com/byok-splunk-observability-alerts/docs"},"termsOfService":"https://connectorbay.com/byok-splunk-observability-alerts/terms"},"servers":[{"url":"https://byok-splunk-observability-alerts.connectorbay.com"}],"externalDocs":{"url":"https://connectorbay.com/byok-splunk-observability-alerts/docs"},"security":[{"upstreamKey":[]}],"components":{"securitySchemes":{"bearer":{"type":"http","scheme":"bearer","description":"Optional. A Pro API key raises rate limits; no credentials are required."},"upstreamKey":{"type":"apiKey","in":"header","name":"X-Upstream-Key","description":"Your own key for the service this connector wraps (bring your own key). Used for that one call only; never stored, logged or cached."}},"schemas":{"Error":{"type":"object","properties":{"ok":{"const":false},"error":{"type":"object"}}}}},"paths":{"/v1/tools/list_detectors":{"post":{"operationId":"list_detectors","summary":"List detectors with name, description, status, tags, teams, origin and the SignalFlow program text (alert rule notificat","description":"List detectors with name, description, status, tags, teams, origin and the SignalFlow program text (alert rule notification targets are not returned). Use for \"Which active detectors do we have in Splunk Observability\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"realm":{"description":"Splunk Observability Cloud realm of your organization (shown on your profile page), for example us1 or eu0.","enum":["us0","us1","eu0","eu1","eu2","au0","jp0","sg0"],"title":"Realm","type":"string"},"name":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Full or partial detector name to search for.","title":"Name"},"tags":{"anyOf":[{"maxLength":100,"type":"string"},{"type":"null"}],"default":null,"description":"Exact tag a detector must have.","title":"Tags"},"order_by":{"anyOf":[{"enum":["creator","created","description","lastUpdated","lastUpdatedBy","name","tags"],"type":"string"},{"type":"null"}],"default":"lastUpdated","description":"Sort field.","title":"Order By"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results to return (1 to 200).","title":"Limit"},"offset":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Index of the first result to return, for paging (default 0).","title":"Offset"}},"required":["realm"],"title":"list_detectorsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_detector":{"post":{"operationId":"get_detector","summary":"Get one detector by id with name, description, status, tags, teams and the SignalFlow program text (no notification targ","description":"Get one detector by id with name, description, status, tags, teams and the SignalFlow program text (no notification targets). Use for \"Show the Splunk Observability detector DET1\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"realm":{"description":"Splunk Observability Cloud realm of your organization (shown on your profile page), for example us1 or eu0.","enum":["us0","us1","eu0","eu1","eu2","au0","jp0","sg0"],"title":"Realm","type":"string"},"detector_id":{"description":"Detector id from list_detectors.","maxLength":60,"title":"Detector Id","type":"string"}},"required":["realm","detector_id"],"title":"get_detectorArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_detector_events":{"post":{"operationId":"list_detector_events","summary":"List the alert events a detector produced in a time range (anomalous or ok state changes) with timestamp, label and inci","description":"List the alert events a detector produced in a time range (anomalous or ok state changes) with timestamp, label and incident id. Use for \"When did Splunk Observability detector DET1 last fire\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"realm":{"description":"Splunk Observability Cloud realm of your organization (shown on your profile page), for example us1 or eu0.","enum":["us0","us1","eu0","eu1","eu2","au0","jp0","sg0"],"title":"Realm","type":"string"},"detector_id":{"description":"Detector id from list_detectors.","maxLength":60,"title":"Detector Id","type":"string"},"from_time":{"anyOf":[{"maximum":9999999999999,"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"description":"Start of the range in epoch milliseconds, inclusive.","title":"From Time"},"to_time":{"anyOf":[{"maximum":9999999999999,"minimum":0,"type":"integer"},{"type":"null"}],"default":null,"description":"End of the range in epoch milliseconds, inclusive.","title":"To Time"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many events to return (default 50).","title":"Limit"},"offset":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Index of the first result to return, for paging (default 0).","title":"Offset"}},"required":["realm","detector_id"],"title":"list_detector_eventsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_detector_incidents":{"post":{"operationId":"list_detector_incidents","summary":"List the incidents a detector generated: active flag, state, severity, duration and events. Use for \"Which incidents did","description":"List the incidents a detector generated: active flag, state, severity, duration and events. Use for \"Which incidents did Splunk Observability detector DET1 create\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"realm":{"description":"Splunk Observability Cloud realm of your organization (shown on your profile page), for example us1 or eu0.","enum":["us0","us1","eu0","eu1","eu2","au0","jp0","sg0"],"title":"Realm","type":"string"},"detector_id":{"description":"Detector id from list_detectors.","maxLength":60,"title":"Detector Id","type":"string"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results to return (1 to 200).","title":"Limit"},"offset":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Index of the first result to return, for paging (default 0).","title":"Offset"}},"required":["realm","detector_id"],"title":"list_detector_incidentsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_incidents":{"post":{"operationId":"list_incidents","summary":"List the latest incident per detector rule: active flag, anomaly state, severity, duration, linked teams and events. Act","description":"List the latest incident per detector rule: active flag, anomaly state, severity, duration, linked teams and events. Active only unless includeResolved is true. Use for \"Which Splunk Observability incidents are active right now\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"realm":{"description":"Splunk Observability Cloud realm of your organization (shown on your profile page), for example us1 or eu0.","enum":["us0","us1","eu0","eu1","eu2","au0","jp0","sg0"],"title":"Realm","type":"string"},"include_resolved":{"anyOf":[{"type":"boolean"},{"type":"null"}],"default":false,"description":"True to return the latest incident of resolved ones instead of only active incidents.","title":"Include Resolved"},"query":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Filter such as teamId:<team id> or <dimension>:<value> (wrap values with special characters in double quotes).","title":"Query"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results to return (1 to 200).","title":"Limit"},"offset":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Index of the first result to return, for paging (default 0).","title":"Offset"}},"required":["realm"],"title":"list_incidentsArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_incident":{"post":{"operationId":"get_incident","summary":"Get one incident by id with state, severity, duration, linked teams and its events. Use for \"Show Splunk Observability i","description":"Get one incident by id with state, severity, duration, linked teams and its events. Use for \"Show Splunk Observability incident INC1\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"realm":{"description":"Splunk Observability Cloud realm of your organization (shown on your profile page), for example us1 or eu0.","enum":["us0","us1","eu0","eu1","eu2","au0","jp0","sg0"],"title":"Realm","type":"string"},"incident_id":{"description":"Incident id from list_incidents.","maxLength":60,"title":"Incident Id","type":"string"}},"required":["realm","incident_id"],"title":"get_incidentArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/list_muting_rules":{"post":{"operationId":"list_muting_rules","summary":"List alert muting rules with description, start and stop time, filters, recurrence and linked teams. Filter by state (pa","description":"List alert muting rules with description, start and stop time, filters, recurrence and linked teams. Filter by state (past, future, ongoing, open, all) or text. Use for \"Which Splunk Observability alert muting rules are active now\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"realm":{"description":"Splunk Observability Cloud realm of your organization (shown on your profile page), for example us1 or eu0.","enum":["us0","us1","eu0","eu1","eu2","au0","jp0","sg0"],"title":"Realm","type":"string"},"include":{"anyOf":[{"enum":["Past","Future","Ongoing","Open","All"],"type":"string"},{"type":"null"}],"default":null,"description":"Which rules: Past, Future, Ongoing, Open (no end date) or All.","title":"Include"},"query":{"anyOf":[{"maxLength":200,"type":"string"},{"type":"null"}],"default":null,"description":"Search such as sf_description:<pattern> or <dimension>:<value>.","title":"Query"},"order_by":{"anyOf":[{"maxLength":60,"type":"string"},{"type":"null"}],"default":null,"description":"Property to sort by; prefix with - for descending (for example -sf_timestamp).","title":"Order By"},"limit":{"anyOf":[{"maximum":200,"minimum":1,"type":"integer"},{"type":"null"}],"default":25,"description":"How many results to return (1 to 200).","title":"Limit"},"offset":{"anyOf":[{"maximum":100000,"minimum":0,"type":"integer"},{"type":"null"}],"default":0,"description":"Index of the first result to return, for paging (default 0).","title":"Offset"}},"required":["realm"],"title":"list_muting_rulesArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}},"/v1/tools/get_muting_rule":{"post":{"operationId":"get_muting_rule","summary":"Get one alert muting rule by id with description, time window, filters and recurrence. Use for \"Show Splunk Observabilit","description":"Get one alert muting rule by id with description, time window, filters and recurrence. Use for \"Show Splunk Observability muting rule M1\".","tags":["tools"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"properties":{"realm":{"description":"Splunk Observability Cloud realm of your organization (shown on your profile page), for example us1 or eu0.","enum":["us0","us1","eu0","eu1","eu2","au0","jp0","sg0"],"title":"Realm","type":"string"},"rule_id":{"description":"Muting rule id from list_muting_rules.","maxLength":60,"title":"Rule Id","type":"string"}},"required":["realm","rule_id"],"title":"get_muting_ruleArguments","type":"object"}}}},"responses":{"200":{"description":"Tool result. `ok: true` on success; `ok: false` with a structured `error` (provider_unavailable, upstream_error, bad_input) when the tool could not answer.","content":{"application/json":{"schema":{"type":"object","additionalProperties":true}}}},"422":{"description":"Arguments failed validation","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"429":{"description":"Rate limit exceeded (see Retry-After)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"x-read-only":true}}}}