---
title: Cribl
slug: connectors/cribl
docTags: 
createdAt: 2026-06-09T16:30:23.073Z
---

Cribl is an observability pipeline platform that optimizes data routing and processing across diverse environments.

Cribl is a powerful observability pipeline that enables users to collect, reduce, and route data from any source to any destination. The Cribl connector for Swimlane Turbine allows users to seamlessly integrate Cribl's capabilities into their security automation workflows. With this integration, users can efficiently manage datasets, logs, notifications, and more, enhancing their ability to analyze and respond to security events. The connector empowers Swimlane Turbine end-users to automate data retrieval and processing tasks, streamlining security operations and improving response times.

## Prerequisites

Before you can use the Cribl connector for Turbine, you'll need access to the Cribl API. This requires the following:

- OAuth 2.0 Client Credentials authentication using the following parameters:
  - URL: The endpoint for accessing Cribl Cloud services.
  - Client ID: The unique identifier for your application.
  - Client Secret: The secret key associated with your client ID.
  - Token URL: The URL used to obtain the OAuth token.
  - Audience: The intended audience for the token.
- HTTP Basic authentication using the following parameters:
  - URL: The endpoint for accessing Cribl OnPrem services.
  - Username: Your Cribl OnPrem account username.
  - Password: Your Cribl OnPrem account password.

## Asset Setup

This Connector supports the below authentication options:

1. OAuth2 Client Credentials Authentication for Cribl Cloud. To set up the asset, you need the following inputs:

- URL
- Client ID
- Client Secret
- Audience
- Token URL

2. OAuth2 Password Authentication for Cribl OnPrem. If you're using SSO/OpenID Connect Authentication, you must toggle Allow local auth on, because you'll need to be a Local user when you authenticate via the API. To set up the asset, you need the following inputs:

- URL
- Username
- Password

## Capabilities

This Connector provides the following capabilities:

- Evaluate Expression
- Get Dataset By ID
- Get Datasets
- Get Job Result
- Get Log By ID
- Get Logs
- Get Lookup File By ID
- Get Lookups
- Get Message By ID
- Get Messages
- Get Notification By ID
- Get Notification Targets
- Get Processes
- Get Role By ID
- Get Roles
  *... and so on*

## API Documentation Link

[Cribl API Documentation Link](https://docs.cribl.io/api/)

[Cribl Authentication Link](https://docs.cribl.io/stream/api-tutorials/#criblcloud-free-tier)

## Additional Documentation

- [Cribl Connector Documentation](https://docs.swimlane.com/connectors/cribl)
- [Cribl API Documentation](https://docs.cribl.io/stream/api-reference/)

# Configurations

## HTTP Basic Authentication

Authenticates Cribl OnPrem using username and password.

### Configuration Parameters

| **Parameter** | **Description**                    | **Type** | **Required** |
| ------------- | ---------------------------------- | -------- | ------------ |
| url           | A URL to the target host.          | string   | Required     |
| username      | Username                           | string   | Required     |
| password      | Password                           | string   | Required     |
| verify\_ssl   | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy   | A proxy to route requests through. | string   | Optional     |

## Oauth 2.0 Client Credentials

Authenticates Cribl Cloud using oauth 2.0 client credentials

### Configuration Parameters

| **Parameter**  | **Description**                    | **Type** | **Required** |
| -------------- | ---------------------------------- | -------- | ------------ |
| url            | A URL to the target host.          | string   | Required     |
| token\_url     |                                    | string   | Required     |
| client\_id     | The client ID                      | string   | Required     |
| client\_secret | The client secret.                 | string   | Required     |
| verify\_ssl    | Verify SSL certificate             | boolean  | Optional     |
| http\_proxy    | A proxy to route requests through. | string   | Optional     |
| audience       | Audience                           | string   | Required     |

# Actions

## Evaluate Expression

Return a list of ExprLibEntry objects in Cribl for evaluating expressions.

### Endpoint

- **URL:** `/lib/expression`
- **Method:** `POST`

### Output

| **Parameter**                   | **Type** | **Description**                             |
| ------------------------------- | -------- | ------------------------------------------- |
| `status_code`                   | number   | HTTP status code of the response            |
| `reason`                        | string   | Response reason phrase                      |
| `count`                         | number   | Count value                                 |
| `items`                         | array    | Output field: items                         |
| `items.context`                 | object   | Output field: items.context                 |
| `items.context.additionalProp1` | object   | Output field: items.context.additionalProp1 |
| `items.evalType`                | string   | Type of the resource                        |
| `items.expr`                    | string   | Output field: items.expr                    |
| `items.id`                      | string   | Unique identifier                           |
| `items.pack`                    | string   | Output field: items.pack                    |
| `items.result`                  | object   | Result of the operation                     |
| `items.result.additionalProp1`  | object   | Result of the operation                     |
| `items.unprotected`             | boolean  | Output field: items.unprotected             |

### Output Example

`{"count":123,"items":[{"context":{},"evalType":"string","expr":"string","id":"12345678-1234-1234-1234-123456789abc","pack":"string","result":{},"unprotected":true}]}`

## Get Dataset By ID

Retrieve a dataset from Cribl using its unique ID provided as a path parameter.

### Endpoint

- **URL:** `/search/datasets/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `count`       | number   | Count value                      |
| `items`       | array    | Output field: items              |

### Output Example

`{"count":123,"items":["string"]}`

## Get Datasets

Get a list of Dataset objects from Cribl for further analysis and processing.

### Endpoint

- **URL:** `/search/datasets`
- **Method:** `GET`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `count`       | number   | Count value                      |
| `items`       | array    | Output field: items              |

### Output Example

`{"count":123,"items":["string"]}`

## Get Job Result

Get results for a discover job in Cribl using the instance ID as a path parameter.

### Endpoint

- **URL:** `/jobs/{{id}}/results`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Job instance id |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `string`      | string   | Output field: string             |

### Output Example

`{"string":"string"}`

## Get Log By ID

Get the contents of a log file in Cribl using the specified ID as a path parameter.

### Endpoint

- **URL:** `/system/logs/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**      | **Type** | **Required** | **Description**                                                               |
| ---------------------- | -------- | ------------ | ----------------------------------------------------------------------------- |
| `path_parameters.id`   | string   | Required     | Log ID                                                                        |
| `parameters.limit`     | number   | Optional     | Maximum number of log lines to retrieve starting from offset.                 |
| `parameters.endOffset` | number   | Optional     | In the current log file to fetch the log events upto.                         |
| `parameters.et`        | number   | Optional     | Epoch timestamp of the earliest event (includes rolled files present on disk) |
| `parameters.lt`        | number   | Optional     | Epoch timestamp of the latest event (includes rolled files present on disk)   |
| `parameters.filter`    | string   | Optional     | Filter                                                                        |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"},"parameters":{"limit":123,"endOffset":123,"et":123,"lt":123,"filter":"string"}}`

### Output

| **Parameter**           | **Type** | **Description**                     |
| ----------------------- | -------- | ----------------------------------- |
| `status_code`           | number   | HTTP status code of the response    |
| `reason`                | string   | Response reason phrase              |
| `count`                 | number   | Count value                         |
| `items`                 | array    | Output field: items                 |
| `items.additionalProp1` | object   | Output field: items.additionalProp1 |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Logs

Get a list of log files from Cribl for analysis and monitoring.

### Endpoint

- **URL:** `/system/logs`
- **Method:** `GET`

### Output

| **Parameter** | **Type** | **Description**                  |
| ------------- | -------- | -------------------------------- |
| `status_code` | number   | HTTP status code of the response |
| `reason`      | string   | Response reason phrase           |
| `count`       | number   | Count value                      |
| `items`       | array    | Output field: items              |
| `items.id`    | string   | Unique identifier                |
| `items.path`  | string   | Output field: items.path         |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Lookup File By ID

Retrieve a lookup file from Cribl using its unique ID provided as a path parameter.

### Endpoint

- **URL:** `/system/lookups/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter**             | **Type** | **Description**                  |
| ------------------------- | -------- | -------------------------------- |
| `status_code`             | number   | HTTP status code of the response |
| `reason`                  | string   | Response reason phrase           |
| `count`                   | number   | Count value                      |
| `items`                   | array    | Output field: items              |
| `items.fileInfo`          | object   | Output field: items.fileInfo     |
| `items.fileInfo.filename` | string   | Name of the resource             |
| `items.id`                | string   | Unique identifier                |
| `items.description`       | string   | Output field: items.description  |
| `items.tags`              | string   | Output field: items.tags         |
| `items.size`              | number   | Output field: items.size         |
| `items.content`           | string   | Response content                 |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{},{}]}}`

## Get Lookups

Get a list of LookupFile objects from Cribl for further analysis and processing.

### Endpoint

- **URL:** `/system/lookups`
- **Method:** `GET`

### Output

| **Parameter**             | **Type** | **Description**                  |
| ------------------------- | -------- | -------------------------------- |
| `status_code`             | number   | HTTP status code of the response |
| `reason`                  | string   | Response reason phrase           |
| `count`                   | number   | Count value                      |
| `items`                   | array    | Output field: items              |
| `items.fileInfo`          | object   | Output field: items.fileInfo     |
| `items.fileInfo.filename` | string   | Name of the resource             |
| `items.id`                | string   | Unique identifier                |
| `items.description`       | string   | Output field: items.description  |
| `items.tags`              | string   | Output field: items.tags         |
| `items.size`              | number   | Output field: items.size         |
| `items.content`           | string   | Response content                 |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{},{}]}}`

## Get Message By ID

Retrieve a BulletinMessage from Cribl using the specified ID as a path parameter.

### Endpoint

- **URL:** `/system/message/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter**    | **Type** | **Description**                  |
| ---------------- | -------- | -------------------------------- |
| `status_code`    | number   | HTTP status code of the response |
| `reason`         | string   | Response reason phrase           |
| `count`          | number   | Count value                      |
| `items`          | array    | Output field: items              |
| `items.id`       | string   | Unique identifier                |
| `items.severity` | string   | Output field: items.severity     |
| `items.title`    | string   | Output field: items.title        |
| `items.text`     | string   | Output field: items.text         |
| `items.time`     | number   | Time value                       |
| `items.group`    | string   | Output field: items.group        |
| `items.metadata` | array    | Response data                    |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Messages

Get a list of BulletinMessage objects from Cribl.

### Endpoint

- **URL:** `/system/messages`
- **Method:** `GET`

### Output

| **Parameter**    | **Type** | **Description**                  |
| ---------------- | -------- | -------------------------------- |
| `status_code`    | number   | HTTP status code of the response |
| `reason`         | string   | Response reason phrase           |
| `count`          | number   | Count value                      |
| `items`          | array    | Output field: items              |
| `items.id`       | string   | Unique identifier                |
| `items.severity` | string   | Output field: items.severity     |
| `items.title`    | string   | Output field: items.title        |
| `items.text`     | string   | Output field: items.text         |
| `items.time`     | number   | Time value                       |
| `items.group`    | string   | Output field: items.group        |
| `items.metadata` | array    | Response data                    |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Notification By ID

Retrieve a notification target in Cribl by specifying the unique ID as a path parameter.

### Endpoint

- **URL:** `/notification-targets/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter**        | **Type** | **Description**                  |
| -------------------- | -------- | -------------------------------- |
| `status_code`        | number   | HTTP status code of the response |
| `reason`             | string   | Response reason phrase           |
| `count`              | number   | Count value                      |
| `items`              | array    | Output field: items              |
| `items.id`           | string   | Unique identifier                |
| `items.type`         | string   | Type of the resource             |
| `items.systemFields` | array    | Output field: items.systemFields |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Notification Targets

Get a list of NotificationTarget objects in Cribl to manage and configure notification endpoints effectively.

### Endpoint

- **URL:** `/notification-targets`
- **Method:** `GET`

### Output

| **Parameter**        | **Type** | **Description**                  |
| -------------------- | -------- | -------------------------------- |
| `status_code`        | number   | HTTP status code of the response |
| `reason`             | string   | Response reason phrase           |
| `count`              | number   | Count value                      |
| `items`              | array    | Output field: items              |
| `items.id`           | string   | Unique identifier                |
| `items.type`         | string   | Type of the resource             |
| `items.systemFields` | array    | Output field: items.systemFields |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Processes

Get a list of processes under management in Cribl.

### Endpoint

- **URL:** `/system/processes`
- **Method:** `GET`

### Output

| **Parameter**               | **Type** | **Description**                         |
| --------------------------- | -------- | --------------------------------------- |
| `status_code`               | number   | HTTP status code of the response        |
| `reason`                    | string   | Response reason phrase                  |
| `count`                     | number   | Count value                             |
| `items`                     | array    | Output field: items                     |
| `items.env`                 | object   | Output field: items.env                 |
| `items.env.additionalProp1` | object   | Output field: items.env.additionalProp1 |
| `items.id`                  | string   | Unique identifier                       |
| `items.pid`                 | number   | Unique identifier                       |
| `items.restartOnExit`       | boolean  | Output field: items.restartOnExit       |
| `items.restarts`            | number   | Output field: items.restarts            |
| `items.startTime`           | number   | Time value                              |
| `items.type`                | string   | Type of the resource                    |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Role By ID

Retrieve a specific role in Cribl using the role ID as a path parameter.

### Endpoint

- **URL:** `/system/roles/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter**       | **Type** | **Description**                  |
| ------------------- | -------- | -------------------------------- |
| `status_code`       | number   | HTTP status code of the response |
| `reason`            | string   | Response reason phrase           |
| `count`             | number   | Count value                      |
| `items`             | array    | Output field: items              |
| `items.description` | string   | Output field: items.description  |
| `items.id`          | string   | Unique identifier                |
| `items.policy`      | array    | Output field: items.policy       |
| `items.tags`        | array    | Output field: items.tags         |
| `items.title`       | string   | Output field: items.title        |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Roles

Get a list of Role objects in Cribl to manage user permissions and access levels.

### Endpoint

- **URL:** `/system/roles`
- **Method:** `GET`

### Output

| **Parameter**       | **Type** | **Description**                  |
| ------------------- | -------- | -------------------------------- |
| `status_code`       | number   | HTTP status code of the response |
| `reason`            | string   | Response reason phrase           |
| `count`             | number   | Count value                      |
| `items`             | array    | Output field: items              |
| `items.description` | string   | Output field: items.description  |
| `items.id`          | string   | Unique identifier                |
| `items.policy`      | array    | Output field: items.policy       |
| `items.tags`        | array    | Output field: items.tags         |
| `items.title`       | string   | Output field: items.title        |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Sample By ID

Retrieve a data sample from Cribl using the specified ID as a path parameter.

### Endpoint

- **URL:** `/system/samples/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter**           | **Type** | **Description**                     |
| ----------------------- | -------- | ----------------------------------- |
| `status_code`           | number   | HTTP status code of the response    |
| `reason`                | string   | Response reason phrase              |
| `count`                 | number   | Count value                         |
| `items`                 | array    | Output field: items                 |
| `items.id`              | string   | Unique identifier                   |
| `items.sampleName`      | string   | Name of the resource                |
| `items.pipelineId`      | string   | Unique identifier                   |
| `items.description`     | string   | Output field: items.description     |
| `items.ttl`             | number   | Output field: items.ttl             |
| `items.tags`            | string   | Output field: items.tags            |
| `items.additionalProp1` | object   | Output field: items.additionalProp1 |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Samples

Get a list of DataSample objects from Cribl for analysis and processing.

### Endpoint

- **URL:** `/system/samples`
- **Method:** `GET`

### Output

| **Parameter**           | **Type** | **Description**                     |
| ----------------------- | -------- | ----------------------------------- |
| `status_code`           | number   | HTTP status code of the response    |
| `reason`                | string   | Response reason phrase              |
| `items`                 | array    | Output field: items                 |
| `items.sampleName`      | string   | Name of the resource                |
| `items.created`         | number   | Output field: items.created         |
| `items.isTemplate`      | boolean  | Output field: items.isTemplate      |
| `items.size`            | number   | Output field: items.size            |
| `items.numEvents`       | number   | Output field: items.numEvents       |
| `items.id`              | string   | Unique identifier                   |
| `items.modified`        | number   | Output field: items.modified        |
| `items.tsTemplateField` | string   | Output field: items.tsTemplateField |
| `count`                 | number   | Count value                         |

### Output Example

`{"status_code":200,"response_headers":{"Strict-Transport-Security":"max-age=31536000; includeSubDomains","x-cribl-api-cache-control":"max-age=300","content-type":"application/json; charset=utf-8","content-length":"3401","date":"Thu, 19 Oct 2023 11:12:35 GMT","connection":"keep-alive","keep-alive":"timeout=5"},"reason":"OK","json_body":{"items":[{"sampleName":"weblog.log","created":1574797148907,"isTemplate":true,"size":44018,"numEvents":100,"id":"weblog","modified":1697029993349},{"sampleName":"...`

## Get Saved Job By ID

Retrieve a saved job from Cribl using its unique ID provided as a path parameter.

### Endpoint

- **URL:** `/lib/jobs/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter**                      | **Type** | **Description**                                |
| ---------------------------------- | -------- | ---------------------------------------------- |
| `status_code`                      | number   | HTTP status code of the response               |
| `reason`                           | string   | Response reason phrase                         |
| `count`                            | number   | Count value                                    |
| `items`                            | array    | Output field: items                            |
| `items.id`                         | string   | Unique identifier                              |
| `items.type`                       | string   | Type of the resource                           |
| `items.ttl`                        | string   | Output field: items.ttl                        |
| `items.removeFields`               | array    | Output field: items.removeFields               |
| `items.resumeOnBoot`               | boolean  | Output field: items.resumeOnBoot               |
| `items.environment`                | string   | Output field: items.environment                |
| `items.schedule`                   | object   | Output field: items.schedule                   |
| `items.schedule.enabled`           | boolean  | Output field: items.schedule.enabled           |
| `items.schedule.cronSchedule`      | string   | Output field: items.schedule.cronSchedule      |
| `items.schedule.maxConcurrentRuns` | number   | Output field: items.schedule.maxConcurrentRuns |
| `items.schedule.skippable`         | boolean  | Output field: items.schedule.skippable         |
| `items.schedule.resumeMissed`      | string   | Output field: items.schedule.resumeMissed      |
| `items.schedule.run`               | object   | Output field: items.schedule.run               |
| `items.streamtags`                 | array    | Output field: items.streamtags                 |
| `items.workerAffinity`             | boolean  | Output field: items.workerAffinity             |
| `items.collector`                  | object   | Output field: items.collector                  |
| `items.collector.type`             | string   | Type of the resource                           |
| `items.collector.conf`             | object   | Output field: items.collector.conf             |
| `items.collector.destructive`      | boolean  | Output field: items.collector.destructive      |
| `items.input`                      | object   | Input data for the action                      |
| `items.input.type`                 | string   | Input data for the action                      |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Saved Jobs

Get a list of SavedJob objects in Cribl.

### Endpoint

- **URL:** `/lib/jobs`
- **Method:** `GET`

### Output

| **Parameter**                      | **Type** | **Description**                                |
| ---------------------------------- | -------- | ---------------------------------------------- |
| `status_code`                      | number   | HTTP status code of the response               |
| `reason`                           | string   | Response reason phrase                         |
| `count`                            | number   | Count value                                    |
| `items`                            | array    | Output field: items                            |
| `items.id`                         | string   | Unique identifier                              |
| `items.type`                       | string   | Type of the resource                           |
| `items.ttl`                        | string   | Output field: items.ttl                        |
| `items.removeFields`               | array    | Output field: items.removeFields               |
| `items.resumeOnBoot`               | boolean  | Output field: items.resumeOnBoot               |
| `items.environment`                | string   | Output field: items.environment                |
| `items.schedule`                   | object   | Output field: items.schedule                   |
| `items.schedule.enabled`           | boolean  | Output field: items.schedule.enabled           |
| `items.schedule.cronSchedule`      | string   | Output field: items.schedule.cronSchedule      |
| `items.schedule.maxConcurrentRuns` | number   | Output field: items.schedule.maxConcurrentRuns |
| `items.schedule.skippable`         | boolean  | Output field: items.schedule.skippable         |
| `items.schedule.resumeMissed`      | string   | Output field: items.schedule.resumeMissed      |
| `items.schedule.run`               | object   | Output field: items.schedule.run               |
| `items.streamtags`                 | array    | Output field: items.streamtags                 |
| `items.workerAffinity`             | boolean  | Output field: items.workerAffinity             |
| `items.collector`                  | object   | Output field: items.collector                  |
| `items.collector.type`             | string   | Type of the resource                           |
| `items.collector.conf`             | object   | Output field: items.collector.conf             |
| `items.collector.destructive`      | boolean  | Output field: items.collector.destructive      |
| `items.input`                      | object   | Input data for the action                      |
| `items.input.type`                 | string   | Input data for the action                      |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Saved Queries

Get a list of SavedQuery objects from Cribl for further analysis and processing.

### Endpoint

- **URL:** `/search/saved`
- **Method:** `GET`

### Output

| **Parameter**                            | **Type** | **Description**                                      |
| ---------------------------------------- | -------- | ---------------------------------------------------- |
| `status_code`                            | number   | HTTP status code of the response                     |
| `reason`                                 | string   | Response reason phrase                               |
| `count`                                  | number   | Count value                                          |
| `items`                                  | array    | Output field: items                                  |
| `items.chartConfig`                      | object   | Output field: items.chartConfig                      |
| `items.chartConfig.axis`                 | object   | Output field: items.chartConfig.axis                 |
| `items.chartConfig.axis.xAxis`           | string   | Output field: items.chartConfig.axis.xAxis           |
| `items.chartConfig.axis.yAxis`           | array    | Output field: items.chartConfig.axis.yAxis           |
| `items.chartConfig.color`                | string   | Output field: items.chartConfig.color                |
| `items.chartConfig.colorPalette`         | number   | Output field: items.chartConfig.colorPalette         |
| `items.chartConfig.colorPaletteReversed` | boolean  | Output field: items.chartConfig.colorPaletteReversed |
| `items.chartConfig.data`                 | object   | Response data                                        |
| `items.chartConfig.data.connectNulls`    | string   | Response data                                        |
| `items.chartConfig.data.stack`           | boolean  | Response data                                        |
| `items.chartConfig.decimals`             | number   | Output field: items.chartConfig.decimals             |
| `items.chartConfig.label`                | string   | Output field: items.chartConfig.label                |
| `items.chartConfig.legend`               | object   | Output field: items.chartConfig.legend               |
| `items.chartConfig.legend.position`      | string   | Output field: items.chartConfig.legend.position      |
| `items.chartConfig.legend.truncate`      | boolean  | Output field: items.chartConfig.legend.truncate      |
| `items.chartConfig.prefix`               | string   | Output field: items.chartConfig.prefix               |
| `items.chartConfig.series`               | array    | Output field: items.chartConfig.series               |
| `items.chartConfig.series.color`         | string   | Output field: items.chartConfig.series.color         |
| `items.chartConfig.series.name`          | string   | Name of the resource                                 |
| `items.chartConfig.series.type`          | object   | Type of the resource                                 |
| `items.chartConfig.series.yAxisField`    | string   | Output field: items.chartConfig.series.yAxisField    |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Saved Query By ID

Retrieve a saved query from Cribl using the specified ID as a path parameter.

### Endpoint

- **URL:** `/search/saved/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter**                            | **Type** | **Description**                                      |
| ---------------------------------------- | -------- | ---------------------------------------------------- |
| `status_code`                            | number   | HTTP status code of the response                     |
| `reason`                                 | string   | Response reason phrase                               |
| `count`                                  | number   | Count value                                          |
| `items`                                  | array    | Output field: items                                  |
| `items.chartConfig`                      | object   | Output field: items.chartConfig                      |
| `items.chartConfig.axis`                 | object   | Output field: items.chartConfig.axis                 |
| `items.chartConfig.axis.xAxis`           | string   | Output field: items.chartConfig.axis.xAxis           |
| `items.chartConfig.axis.yAxis`           | array    | Output field: items.chartConfig.axis.yAxis           |
| `items.chartConfig.color`                | string   | Output field: items.chartConfig.color                |
| `items.chartConfig.colorPalette`         | number   | Output field: items.chartConfig.colorPalette         |
| `items.chartConfig.colorPaletteReversed` | boolean  | Output field: items.chartConfig.colorPaletteReversed |
| `items.chartConfig.data`                 | object   | Response data                                        |
| `items.chartConfig.data.connectNulls`    | string   | Response data                                        |
| `items.chartConfig.data.stack`           | boolean  | Response data                                        |
| `items.chartConfig.decimals`             | number   | Output field: items.chartConfig.decimals             |
| `items.chartConfig.label`                | string   | Output field: items.chartConfig.label                |
| `items.chartConfig.legend`               | object   | Output field: items.chartConfig.legend               |
| `items.chartConfig.legend.position`      | string   | Output field: items.chartConfig.legend.position      |
| `items.chartConfig.legend.truncate`      | boolean  | Output field: items.chartConfig.legend.truncate      |
| `items.chartConfig.prefix`               | string   | Output field: items.chartConfig.prefix               |
| `items.chartConfig.series`               | array    | Output field: items.chartConfig.series               |
| `items.chartConfig.series.color`         | string   | Output field: items.chartConfig.series.color         |
| `items.chartConfig.series.name`          | string   | Name of the resource                                 |
| `items.chartConfig.series.type`          | object   | Type of the resource                                 |
| `items.chartConfig.series.yAxisField`    | string   | Output field: items.chartConfig.series.yAxisField    |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Search Job By ID

Retrieve a specific search job in Cribl using its unique ID provided as a path parameter.

### Endpoint

- **URL:** `/search/jobs/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter**                            | **Type** | **Description**                                      |
| ---------------------------------------- | -------- | ---------------------------------------------------- |
| `status_code`                            | number   | HTTP status code of the response                     |
| `reason`                                 | string   | Response reason phrase                               |
| `count`                                  | number   | Count value                                          |
| `items`                                  | array    | Output field: items                                  |
| `items.chartConfig`                      | object   | Output field: items.chartConfig                      |
| `items.chartConfig.axis`                 | object   | Output field: items.chartConfig.axis                 |
| `items.chartConfig.axis.xAxis`           | string   | Output field: items.chartConfig.axis.xAxis           |
| `items.chartConfig.axis.yAxis`           | array    | Output field: items.chartConfig.axis.yAxis           |
| `items.chartConfig.color`                | string   | Output field: items.chartConfig.color                |
| `items.chartConfig.colorPalette`         | number   | Output field: items.chartConfig.colorPalette         |
| `items.chartConfig.colorPaletteReversed` | boolean  | Output field: items.chartConfig.colorPaletteReversed |
| `items.chartConfig.data`                 | object   | Response data                                        |
| `items.chartConfig.data.connectNulls`    | string   | Response data                                        |
| `items.chartConfig.data.stack`           | boolean  | Response data                                        |
| `items.chartConfig.decimals`             | number   | Output field: items.chartConfig.decimals             |
| `items.chartConfig.label`                | string   | Output field: items.chartConfig.label                |
| `items.chartConfig.legend`               | object   | Output field: items.chartConfig.legend               |
| `items.chartConfig.legend.position`      | string   | Output field: items.chartConfig.legend.position      |
| `items.chartConfig.legend.truncate`      | boolean  | Output field: items.chartConfig.legend.truncate      |
| `items.chartConfig.prefix`               | string   | Output field: items.chartConfig.prefix               |
| `items.chartConfig.series`               | array    | Output field: items.chartConfig.series               |
| `items.chartConfig.series.color`         | string   | Output field: items.chartConfig.series.color         |
| `items.chartConfig.series.name`          | string   | Name of the resource                                 |
| `items.chartConfig.series.type`          | object   | Type of the resource                                 |
| `items.chartConfig.series.yAxisField`    | string   | Output field: items.chartConfig.series.yAxisField    |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Search Jobs

Get a list of SearchJob objects from Cribl to review and manage ongoing search operations.

### Endpoint

- **URL:** `/search/jobs`
- **Method:** `GET`

### Output

| **Parameter**                            | **Type** | **Description**                                      |
| ---------------------------------------- | -------- | ---------------------------------------------------- |
| `status_code`                            | number   | HTTP status code of the response                     |
| `reason`                                 | string   | Response reason phrase                               |
| `count`                                  | number   | Count value                                          |
| `items`                                  | array    | Output field: items                                  |
| `items.chartConfig`                      | object   | Output field: items.chartConfig                      |
| `items.chartConfig.axis`                 | object   | Output field: items.chartConfig.axis                 |
| `items.chartConfig.axis.xAxis`           | string   | Output field: items.chartConfig.axis.xAxis           |
| `items.chartConfig.axis.yAxis`           | array    | Output field: items.chartConfig.axis.yAxis           |
| `items.chartConfig.color`                | string   | Output field: items.chartConfig.color                |
| `items.chartConfig.colorPalette`         | number   | Output field: items.chartConfig.colorPalette         |
| `items.chartConfig.colorPaletteReversed` | boolean  | Output field: items.chartConfig.colorPaletteReversed |
| `items.chartConfig.data`                 | object   | Response data                                        |
| `items.chartConfig.data.connectNulls`    | string   | Response data                                        |
| `items.chartConfig.data.stack`           | boolean  | Response data                                        |
| `items.chartConfig.decimals`             | number   | Output field: items.chartConfig.decimals             |
| `items.chartConfig.label`                | string   | Output field: items.chartConfig.label                |
| `items.chartConfig.legend`               | object   | Output field: items.chartConfig.legend               |
| `items.chartConfig.legend.position`      | string   | Output field: items.chartConfig.legend.position      |
| `items.chartConfig.legend.truncate`      | boolean  | Output field: items.chartConfig.legend.truncate      |
| `items.chartConfig.prefix`               | string   | Output field: items.chartConfig.prefix               |
| `items.chartConfig.series`               | array    | Output field: items.chartConfig.series               |
| `items.chartConfig.series.color`         | string   | Output field: items.chartConfig.series.color         |
| `items.chartConfig.series.name`          | string   | Name of the resource                                 |
| `items.chartConfig.series.type`          | object   | Type of the resource                                 |
| `items.chartConfig.series.yAxisField`    | string   | Output field: items.chartConfig.series.yAxisField    |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Secret By ID

Retrieve a RestSecret from Cribl using the specified ID as a path parameter.

### Endpoint

- **URL:** `/system/secrets/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter**       | **Type** | **Description**                  |
| ------------------- | -------- | -------------------------------- |
| `status_code`       | number   | HTTP status code of the response |
| `reason`            | string   | Response reason phrase           |
| `count`             | number   | Count value                      |
| `items`             | array    | Output field: items              |
| `items.apiKey`      | string   | Output field: items.apiKey       |
| `items.description` | string   | Output field: items.description  |
| `items.id`          | string   | Unique identifier                |
| `items.password`    | string   | Output field: items.password     |
| `items.secretKey`   | string   | Output field: items.secretKey    |
| `items.secretType`  | string   | Type of the resource             |
| `items.tags`        | string   | Output field: items.tags         |
| `items.username`    | string   | Name of the resource             |
| `items.value`       | string   | Value for the parameter          |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Secrets

Get a list of RestSecret objects from Cribl for secure data handling and management.

### Endpoint

- **URL:** `/system/secrets`
- **Method:** `GET`

### Output

| **Parameter**       | **Type** | **Description**                  |
| ------------------- | -------- | -------------------------------- |
| `status_code`       | number   | HTTP status code of the response |
| `reason`            | string   | Response reason phrase           |
| `count`             | number   | Count value                      |
| `items`             | array    | Output field: items              |
| `items.apiKey`      | string   | Output field: items.apiKey       |
| `items.description` | string   | Output field: items.description  |
| `items.id`          | string   | Unique identifier                |
| `items.password`    | string   | Output field: items.password     |
| `items.secretKey`   | string   | Output field: items.secretKey    |
| `items.secretType`  | string   | Type of the resource             |
| `items.tags`        | string   | Output field: items.tags         |
| `items.username`    | string   | Name of the resource             |
| `items.value`       | string   | Value for the parameter          |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get User By ID

Retrieve user details from Cribl using a unique user ID as a path parameter.

### Endpoint

- **URL:** `/system/users/{{id}}`
- **Method:** `GET`

### Input

| **Argument Name**    | **Type** | **Required** | **Description** |
| -------------------- | -------- | ------------ | --------------- |
| `path_parameters.id` | string   | Required     | Unique ID       |

### Input Example

`{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}`

### Output

| **Parameter**           | **Type** | **Description**                     |
| ----------------------- | -------- | ----------------------------------- |
| `status_code`           | number   | HTTP status code of the response    |
| `reason`                | string   | Response reason phrase              |
| `count`                 | number   | Count value                         |
| `items`                 | array    | Output field: items                 |
| `items.currentPassword` | string   | Output field: items.currentPassword |
| `items.disabled`        | boolean  | Output field: items.disabled        |
| `items.email`           | string   | Output field: items.email           |
| `items.first`           | string   | Output field: items.first           |
| `items.id`              | string   | Unique identifier                   |
| `items.last`            | string   | Output field: items.last            |
| `items.password`        | string   | Output field: items.password        |
| `items.roles`           | array    | Output field: items.roles           |
| `items.username`        | string   | Name of the resource                |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

## Get Users

Get a list of User objects from Cribl.

### Endpoint

- **URL:** `/system/users`
- **Method:** `GET`

### Output

| **Parameter**           | **Type** | **Description**                     |
| ----------------------- | -------- | ----------------------------------- |
| `status_code`           | number   | HTTP status code of the response    |
| `reason`                | string   | Response reason phrase              |
| `count`                 | number   | Count value                         |
| `items`                 | array    | Output field: items                 |
| `items.currentPassword` | string   | Output field: items.currentPassword |
| `items.disabled`        | boolean  | Output field: items.disabled        |
| `items.email`           | string   | Output field: items.email           |
| `items.first`           | string   | Output field: items.first           |
| `items.id`              | string   | Unique identifier                   |
| `items.last`            | string   | Output field: items.last            |
| `items.password`        | string   | Output field: items.password        |
| `items.roles`           | array    | Output field: items.roles           |
| `items.username`        | string   | Name of the resource                |

### Output Example

`{"status_code":200,"response_headers":{"Date":"Fri, 06 Oct 2023 06:05:14 GMT","Content-Type":"application/json;charset=UTF-8","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, no-store, private, max-age=0, must-revalidate","Strict-Transport-Security":"max-age=31536000","X-Frame-Options":"SAMEORIGIN","X-Content-Type-Options":"nosniff"},"reason":"OK","json_body":{"count":0,"items":[{}]}}`

# Response Headers

| **Header**                | **Description**                                       | **Example**                                             |
| ------------------------- | ----------------------------------------------------- | ------------------------------------------------------- |
| Cache-Control             | Directives for caching mechanisms                     | no-cache, no-store, private, max-age=0, must-revalidate |
| connection                | HTTP response header: connection                      | keep-alive                                              |
| content-length            | The length of the response body in bytes              | 3401                                                    |
| Content-Type              | The media type of the resource                        | application/json;charset=UTF-8                          |
| date                      | The date and time at which the message was originated | Thu, 19 Oct 2023 11:12:35 GMT                           |
| keep-alive                | HTTP response header: keep-alive                      | timeout=5                                               |
| Strict-Transport-Security | HTTP response header: Strict-Transport-Security       | max-age=31536000                                        |
| Transfer-Encoding         | HTTP response header: Transfer-Encoding               | chunked                                                 |
| X-Content-Type-Options    | HTTP response header: X-Content-Type-Options          | nosniff                                                 |
| x-cribl-api-cache-control | HTTP response header: x-cribl-api-cache-control       | max-age=300                                             |
| X-Frame-Options           | HTTP response header: X-Frame-Options                 | SAMEORIGIN                                              |