> ## Documentation Index > Fetch the complete documentation index at: https://docs.2501.ai/llms.txt > Use this file to discover all available pages before exploring further. # Receive a Splunk alert > Experimental: this endpoint and its body may change in later releases. The URL for a Splunk alert action. It takes the signal key of one organization, created with `2501 infra webhook create --source-type splunk`, and records the alert as a signal of that organization, whatever the body says. An API key or a session is refused with 401. The key is checked before the body, so a request without a valid key gets 401 and nothing else. Alerts from the same search with the same text and machine are counted into one signal; occurrence_count is its count so far. A redelivery of a sid already recorded answers 200 with already_counted and is not counted again, so Splunk can resend safely. Observability turned off for the installation answers 403. Errors from this route carry code ENGINE_ERROR. ## OpenAPI ````yaml /0.17/openapi.json post /api/v1/signals openapi: 3.0.3 info: title: 2501 Public API version: v1 description: >- The stable, versioned HTTP API for driving 2501 as code. See the API Overview for authentication, the org_id rule, cursor pagination, and the error envelope. servers: - url: https://{command_center_host} variables: command_center_host: default: your-command-center-host description: Your Command Center host security: - bearerAuth: [] paths: /api/v1/signals: post: tags: - Signals summary: Receive a Splunk alert description: >- Experimental: this endpoint and its body may change in later releases. The URL for a Splunk alert action. It takes the signal key of one organization, created with `2501 infra webhook create --source-type splunk`, and records the alert as a signal of that organization, whatever the body says. An API key or a session is refused with 401. The key is checked before the body, so a request without a valid key gets 401 and nothing else. Alerts from the same search with the same text and machine are counted into one signal; occurrence_count is its count so far. A redelivery of a sid already recorded answers 200 with already_counted and is not counted again, so Splunk can resend safely. Observability turned off for the installation answers 403. Errors from this route carry code ENGINE_ERROR. requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/SplunkAlert' responses: '200': description: The signal the alert was counted into content: application/json: schema: $ref: '#/components/schemas/SignalIntakeResult' '400': description: >- Bad request - a field is missing, malformed, or not allowed (VALIDATION_FAILED, BAD_REQUEST, INVALID_CURSOR) content: application/json: schema: $ref: '#/components/schemas/Error' '401': description: >- No credentials, or a key that is invalid, revoked, or expired (UNAUTHORIZED) content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: >- Authenticated but not allowed (FORBIDDEN, ORG_ACCESS_DENIED, STEP_UP_REFUSED, TWO_FACTOR_ENROLLMENT_REQUIRED, LICENSE_CAP_REACHED, LICENSE_EXPIRED) content: application/json: schema: $ref: '#/components/schemas/Error' security: - signalKey: [] components: schemas: SplunkAlert: type: object properties: sid: anyOf: - type: string - type: array items: type: string description: >- The search job ID. It identifies the firing, so a redelivery is not counted twice. A multivalue sid uses its first value. example: scheduler__admin__search__RMD5_at_1791534708_42 search_name: nullable: true anyOf: - type: string - type: array items: type: string description: The saved search. It is the signal text when the result has none. example: Disk full on state volume app: nullable: true anyOf: - type: string - type: array items: type: string description: The Splunk app the search runs in. It is kept with the signal. example: search result: type: object properties: problem: nullable: true anyOf: - type: string - type: array items: type: string description: The signal text, when present. message: nullable: true anyOf: - type: string - type: array items: type: string description: The signal text, when problem is absent. description: nullable: true anyOf: - type: string - type: array items: type: string description: The signal text, when problem and message are absent. host: nullable: true anyOf: - type: string - type: array items: type: string description: The machine, when present. ip: nullable: true anyOf: - type: string - type: array items: type: string description: The machine, when host is absent. dest_ip: nullable: true anyOf: - type: string - type: array items: type: string description: The machine, when host and ip are absent. src_ip: nullable: true anyOf: - type: string - type: array items: type: string description: The machine, when host, ip and dest_ip are absent. sourceIPAddress: nullable: true anyOf: - type: string - type: array items: type: string description: The machine, when host, ip, dest_ip and src_ip are absent. severity: nullable: true anyOf: - type: string - type: array items: type: string description: >- critical, fatal, high, error, medium, warn, warning, low, info, informational or debug, in any case. Anything else, or none, counts as warning. detected_at: nullable: true anyOf: - type: string - type: number - type: array items: anyOf: - type: string - type: number description: >- When the problem was detected: epoch seconds, as Splunk writes them, as a string or a number, or a date. Without it, the time the alert arrives. An unreadable value is a 400. example: '1791534708.512' additionalProperties: nullable: true description: >- The first result row of the search. The first of problem, message and description present is the signal text, and the first of host, ip, dest_ip, src_ip and sourceIPAddress names the machine. Every column is kept with the signal. A multivalue field uses its first value. required: - sid additionalProperties: nullable: true description: The JSON body Splunk sends for an alert action. SignalIntakeResult: anyOf: - type: object properties: signal_id: type: string example: sig_e4499e94-91ad-4954-9a01-15bd63abc061 fingerprint: type: string description: >- What the alerts counted into this signal have in common: the search, the text and the machine. example: 2fb7c6ca597df4ed occurrence_count: type: integer example: 1 required: - signal_id - fingerprint - occurrence_count - type: object properties: already_counted: type: boolean enum: - true external_id: type: string description: The sid of the alert, recorded before. required: - already_counted - external_id Error: type: object properties: code: type: string example: VALIDATION_FAILED message: type: string example: Validation failed request_id: type: string example: req_3702b7e7-... field: type: string description: Set when one input is at fault errors: type: array items: type: object properties: field: type: string message: type: string required: - field - message description: Set when several inputs are at fault details: type: object additionalProperties: nullable: true required: - code - message - request_id securitySchemes: bearerAuth: type: http scheme: bearer description: >- An API key minted in Command Center (Settings -> API Keys), sent as `Authorization: Bearer 2501_ak_...`. A Command Center session cookie is also accepted. signalKey: type: http scheme: bearer description: >- A per-organization signal key, created with `2501 infra webhook create --source-type splunk` and shown once, sent as `Authorization: Bearer 2501_wh_...`. It is accepted only by POST /api/v1/signals. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.