--- title: "Changes to Update metadata for an HEC token for a Splunk HEC Source" method: PATCH path: "/system/inputs/{id}/hectoken/{token}" --- # Changes to Update metadata for an HEC token for a Splunk HEC Source `PATCH /system/inputs/{id}/hectoken/{token}` > Every recorded change to this operation, newest first. ## Timeline Changed in 18 of 89 revisions. - **2026-10-18** `fd542bb248a2`: 2 info - **2026-09-12** `3816b6fddba1`: 3 info - **2026-08-14** `f24e21d4ad84`: 2 info - **2026-07-23** `e9bef570d106`: 8 info - **2026-05-15** `484cda0ad459`: 4 info - **2026-03-06** `11df16b26c1d`: 1 warning, 3 info - **2026-01-25** `84748faee3ef`: 3 breaking, 35 info - **2026-01-19** `62472462b0c0`: 2 breaking, 36 info - **2026-01-19** `78a6165ee901`: 3 breaking, 35 info - **2025-12-12** `0daa47a796bf`: 1 info - **2025-12-01** `adb53b98a4c5`: 2 breaking - **2025-12-01** `df34abcdfc7c`: 2 breaking - **2025-11-15** `72b542d3fe49`: 2 breaking, 2 info - **2025-10-23** `446f13dcf6da`: 38 info - **2025-10-10** `263fc2a93add`: 4 breaking, 34 warning - **2025-10-09** `44245bdb7885`: 38 info - **2025-07-23** `c24493f4f779`: 2 info - **2025-07-17** `8ab33f67f808`: 1 info ## Changes - **2026-10-18** `fd542bb248a2`: 2 info - added the non-success response with the status `423` - added the non-success response with the status `503` - **2026-09-12** `3816b6fddba1`: 3 info - added the optional property `items/items/autoParse` to the response with the `200` status - added the optional property `items/items/criblSourceProvenance/sourceService` to the response with the `200` status - added the optional property `items/items/criblSourceProvenance/templateFamily` to the response with the `200` status - **2026-08-14** `f24e21d4ad84`: 2 info - added the optional property `items/items/captureHeadersWarning` to the response with the `200` status - added the optional property `items/items/criblSourceProvenance/accountId` to the response with the `200` status - **2026-07-23** `e9bef570d106`: 8 info - added the media type `application/json` for the response with the status `401` - added the non-success response with the status `400` - added the optional property `details` to the response with the `500` status - added the optional property `items/items/pq/onBackpressure` to the response with the `200` status - the response property `count` became required for the status `200` - the response property `items` became required for the status `200` - the response property `message` became required for the status `500` - added the required property `status` to the response with the `500` status - **2026-05-15** `484cda0ad459`: 4 info - added the optional property `items/items/__template_environment` to the response with the `200` status - added the optional property `items/items/__template_streamtags` to the response with the `200` status - added the optional property `items/items/criblSourceProvenance` to the response with the `200` status - added the optional property `items/items/pq/maxBufferSizeBytes` to the response with the `200` status - **2026-03-06** `11df16b26c1d`: 1 warning, 3 info - removed the optional property `items/items/enableHealthCheck` from the response with the `200` status - added the optional property `items/items/__template_host` to the response with the `200` status - added the optional property `items/items/__template_port` to the response with the `200` status - added the optional property `items/items/__template_splunkHecAPI` to the response with the `200` status - **2026-01-25** `84748faee3ef`: 3 breaking, 35 info - the response property `items/items/connections/items/output` became optional for the status `200` - the `items/items/authTokens/items/token` response's property type changed from no type to `string` for status `200` - the `items/items/authTokens/items/tokenSecret` response's property type changed from no type to `string` for status `200` - the `activityLogSampleRate` response's property default value `100` was removed for the status `200` - the `authType` response's property default value `manual` was removed for the status `200` - the `captureHeaders` response's property default value `false` was removed for the status `200` - the `commitFrequency` response's property default value `42` was removed for the status `200` - the `commonNameRegex` response's property default value `/.*/` was removed for the status `200` - the `compress` response's property default value `none` was removed for the status `200` - the `disabled` response's property default value `false` was removed for the status `200` - the `disabled` response's property default value `true` was removed for the status `200` - the `dropControlFields` response's property default value `true` was removed for the status `200` - the `emitTokenMetrics` response's property default value `false` was removed for the status `200` - the `enableProxyHeader` response's property default value `false` was removed for the status `200` - the `enabled` response's property default value `true` was removed for the status `200` - the `extractMetrics` response's property default value `false` was removed for the status `200` - the `host` response's property default value `0.0.0.0` was removed for the status `200` - the `ipAllowlistRegex` response's property default value `/.*/` was removed for the status `200` - the `ipDenylistRegex` response's property default value `/^$/` was removed for the status `200` - the `keepAliveTimeout` response's property default value `5` was removed for the status `200` - the `maxActiveReq` response's property default value `256` was removed for the status `200` - the `maxBufferSize` response's property default value `1000` was removed for the status `200` - the `maxFileSize` response's property default value `1 MB` was removed for the status `200` - the `maxRequestsPerSocket` response's property default value `0` was removed for the status `200` - the `maxSize` response's property default value `5GB` was removed for the status `200` - the `mode` response's property default value `always` was removed for the status `200` - the `path` response's property default value `$CRIBL_HOME/state/queues` was removed for the status `200` - the `pqEnabled` response's property default value `false` was removed for the status `200` - the `rejectUnauthorized` response's property default value `true` was removed for the status `200` - the `requestCert` response's property default value `false` was removed for the status `200` - the `requestTimeout` response's property default value `0` was removed for the status `200` - the `sendToRoutes` response's property default value `true` was removed for the status `200` - the `socketTimeout` response's property default value `0` was removed for the status `200` - the `splunkHecAPI` response's property default value `/services/collector` was removed for the status `200` - the `splunkHecAcks` response's property default value `false` was removed for the status `200` - the `staleChannelFlushMs` response's property default value `10000` was removed for the status `200` - the `streamtags` response's property default value `` was removed for the status `200` - the `useFwdTimezone` response's property default value `true` was removed for the status `200` - …this revision’s changelog is incomplete - **2026-01-19** `62472462b0c0`: 2 breaking, 36 info - the `items/items/authTokens/items/token` response's property type changed from `string` to no type for status `200` - the `items/items/authTokens/items/tokenSecret` response's property type changed from `string` to no type for status `200` - the response property `items/items/connections/items/output` became required for the status `200` - the `activityLogSampleRate` response's property default value `100` was added for the status `200` - the `authType` response's property default value `manual` was added for the status `200` - the `captureHeaders` response's property default value `false` was added for the status `200` - the `commitFrequency` response's property default value `42` was added for the status `200` - the `commonNameRegex` response's property default value `/.*/` was added for the status `200` - the `compress` response's property default value `none` was added for the status `200` - the `disabled` response's property default value `false` was added for the status `200` - the `disabled` response's property default value `true` was added for the status `200` - the `dropControlFields` response's property default value `true` was added for the status `200` - the `emitTokenMetrics` response's property default value `false` was added for the status `200` - the `enableProxyHeader` response's property default value `false` was added for the status `200` - the `enabled` response's property default value `true` was added for the status `200` - the `extractMetrics` response's property default value `false` was added for the status `200` - the `host` response's property default value `0.0.0.0` was added for the status `200` - the `ipAllowlistRegex` response's property default value `/.*/` was added for the status `200` - the `ipDenylistRegex` response's property default value `/^$/` was added for the status `200` - the `keepAliveTimeout` response's property default value `5` was added for the status `200` - the `maxActiveReq` response's property default value `256` was added for the status `200` - the `maxBufferSize` response's property default value `1000` was added for the status `200` - the `maxFileSize` response's property default value `1 MB` was added for the status `200` - the `maxRequestsPerSocket` response's property default value `0` was added for the status `200` - the `maxSize` response's property default value `5GB` was added for the status `200` - the `mode` response's property default value `always` was added for the status `200` - the `path` response's property default value `$CRIBL_HOME/state/queues` was added for the status `200` - the `pqEnabled` response's property default value `false` was added for the status `200` - the `rejectUnauthorized` response's property default value `true` was added for the status `200` - the `requestCert` response's property default value `false` was added for the status `200` - the `requestTimeout` response's property default value `0` was added for the status `200` - the `sendToRoutes` response's property default value `true` was added for the status `200` - the `socketTimeout` response's property default value `0` was added for the status `200` - the `splunkHecAPI` response's property default value `/services/collector` was added for the status `200` - the `splunkHecAcks` response's property default value `false` was added for the status `200` - the `staleChannelFlushMs` response's property default value `10000` was added for the status `200` - the `streamtags` response's property default value `` was added for the status `200` - the `useFwdTimezone` response's property default value `true` was added for the status `200` - …this revision’s changelog is incomplete - **2026-01-19** `78a6165ee901`: 3 breaking, 35 info - the response property `items/items/connections/items/output` became optional for the status `200` - the `items/items/authTokens/items/token` response's property type changed from no type to `string` for status `200` - the `items/items/authTokens/items/tokenSecret` response's property type changed from no type to `string` for status `200` - the `activityLogSampleRate` response's property default value `100` was removed for the status `200` - the `authType` response's property default value `manual` was removed for the status `200` - the `captureHeaders` response's property default value `false` was removed for the status `200` - the `commitFrequency` response's property default value `42` was removed for the status `200` - the `commonNameRegex` response's property default value `/.*/` was removed for the status `200` - the `compress` response's property default value `none` was removed for the status `200` - the `disabled` response's property default value `false` was removed for the status `200` - the `disabled` response's property default value `true` was removed for the status `200` - the `dropControlFields` response's property default value `true` was removed for the status `200` - the `emitTokenMetrics` response's property default value `false` was removed for the status `200` - the `enableProxyHeader` response's property default value `false` was removed for the status `200` - the `enabled` response's property default value `true` was removed for the status `200` - the `extractMetrics` response's property default value `false` was removed for the status `200` - the `host` response's property default value `0.0.0.0` was removed for the status `200` - the `ipAllowlistRegex` response's property default value `/.*/` was removed for the status `200` - the `ipDenylistRegex` response's property default value `/^$/` was removed for the status `200` - the `keepAliveTimeout` response's property default value `5` was removed for the status `200` - the `maxActiveReq` response's property default value `256` was removed for the status `200` - the `maxBufferSize` response's property default value `1000` was removed for the status `200` - the `maxFileSize` response's property default value `1 MB` was removed for the status `200` - the `maxRequestsPerSocket` response's property default value `0` was removed for the status `200` - the `maxSize` response's property default value `5GB` was removed for the status `200` - the `mode` response's property default value `always` was removed for the status `200` - the `path` response's property default value `$CRIBL_HOME/state/queues` was removed for the status `200` - the `pqEnabled` response's property default value `false` was removed for the status `200` - the `rejectUnauthorized` response's property default value `true` was removed for the status `200` - the `requestCert` response's property default value `false` was removed for the status `200` - the `requestTimeout` response's property default value `0` was removed for the status `200` - the `sendToRoutes` response's property default value `true` was removed for the status `200` - the `socketTimeout` response's property default value `0` was removed for the status `200` - the `splunkHecAPI` response's property default value `/services/collector` was removed for the status `200` - the `splunkHecAcks` response's property default value `false` was removed for the status `200` - the `staleChannelFlushMs` response's property default value `10000` was removed for the status `200` - the `streamtags` response's property default value `` was removed for the status `200` - the `useFwdTimezone` response's property default value `true` was removed for the status `200` - …this revision’s changelog is incomplete - **2025-12-12** `0daa47a796bf`: 1 info - added the new optional request property `allowedIndexesAtToken` - **2025-12-01** `adb53b98a4c5`: 2 breaking - the `items/items/authTokens/items/token` response's property type changed from `string` to no type for status `200` - the `items/items/authTokens/items/tokenSecret` response's property type changed from `string` to no type for status `200` - **2025-12-01** `df34abcdfc7c`: 2 breaking - the `items/items/authTokens/items/token` response's property type changed from no type to `string` for status `200` - the `items/items/authTokens/items/tokenSecret` response's property type changed from no type to `string` for status `200` - **2025-11-15** `72b542d3fe49`: 2 breaking, 2 info - the `items/items/tls/commonNameRegex` response's property type changed from no type to `string` for status `200` - the `items/items/tls/rejectUnauthorized` response's property type changed from no type to `boolean` for status `200` - the `commonNameRegex` response's property default value `/.*/` was added for the status `200` - the `rejectUnauthorized` response's property default value `true` was added for the status `200` - **2025-10-23** `446f13dcf6da`: 38 info - added the optional property `items/items/accessControlAllowHeaders` to the response with the `200` status - added the optional property `items/items/accessControlAllowOrigin` to the response with the `200` status - added the optional property `items/items/activityLogSampleRate` to the response with the `200` status - added the optional property `items/items/allowedIndexes` to the response with the `200` status - added the optional property `items/items/authTokens` to the response with the `200` status - added the optional property `items/items/breakerRulesets` to the response with the `200` status - added the optional property `items/items/captureHeaders` to the response with the `200` status - added the optional property `items/items/connections` to the response with the `200` status - added the optional property `items/items/description` to the response with the `200` status - added the optional property `items/items/disabled` to the response with the `200` status - added the optional property `items/items/dropControlFields` to the response with the `200` status - added the optional property `items/items/emitTokenMetrics` to the response with the `200` status - added the optional property `items/items/enableHealthCheck` to the response with the `200` status - added the optional property `items/items/enableProxyHeader` to the response with the `200` status - added the optional property `items/items/environment` to the response with the `200` status - added the optional property `items/items/extractMetrics` to the response with the `200` status - added the optional property `items/items/id` to the response with the `200` status - added the optional property `items/items/ipAllowlistRegex` to the response with the `200` status - added the optional property `items/items/ipDenylistRegex` to the response with the `200` status - added the optional property `items/items/keepAliveTimeout` to the response with the `200` status - added the optional property `items/items/maxActiveReq` to the response with the `200` status - added the optional property `items/items/maxRequestsPerSocket` to the response with the `200` status - added the optional property `items/items/metadata` to the response with the `200` status - added the optional property `items/items/pipeline` to the response with the `200` status - added the optional property `items/items/pq` to the response with the `200` status - added the optional property `items/items/pqEnabled` to the response with the `200` status - added the optional property `items/items/requestTimeout` to the response with the `200` status - added the optional property `items/items/sendToRoutes` to the response with the `200` status - added the optional property `items/items/socketTimeout` to the response with the `200` status - added the optional property `items/items/splunkHecAcks` to the response with the `200` status - added the optional property `items/items/staleChannelFlushMs` to the response with the `200` status - added the optional property `items/items/streamtags` to the response with the `200` status - added the optional property `items/items/tls` to the response with the `200` status - added the optional property `items/items/useFwdTimezone` to the response with the `200` status - added the required property `items/items/host` to the response with the `200` status - added the required property `items/items/port` to the response with the `200` status - added the required property `items/items/splunkHecAPI` to the response with the `200` status - added the required property `items/items/type` to the response with the `200` status - **2025-10-10** `263fc2a93add`: 4 breaking, 34 warning - removed the required property `items/items/host` from the response with the `200` status - removed the required property `items/items/port` from the response with the `200` status - removed the required property `items/items/splunkHecAPI` from the response with the `200` status - removed the required property `items/items/type` from the response with the `200` status - removed the optional property `items/items/accessControlAllowHeaders` from the response with the `200` status - removed the optional property `items/items/accessControlAllowOrigin` from the response with the `200` status - removed the optional property `items/items/activityLogSampleRate` from the response with the `200` status - removed the optional property `items/items/allowedIndexes` from the response with the `200` status - removed the optional property `items/items/authTokens` from the response with the `200` status - removed the optional property `items/items/breakerRulesets` from the response with the `200` status - removed the optional property `items/items/captureHeaders` from the response with the `200` status - removed the optional property `items/items/connections` from the response with the `200` status - removed the optional property `items/items/description` from the response with the `200` status - removed the optional property `items/items/disabled` from the response with the `200` status - removed the optional property `items/items/dropControlFields` from the response with the `200` status - removed the optional property `items/items/emitTokenMetrics` from the response with the `200` status - removed the optional property `items/items/enableHealthCheck` from the response with the `200` status - removed the optional property `items/items/enableProxyHeader` from the response with the `200` status - removed the optional property `items/items/environment` from the response with the `200` status - removed the optional property `items/items/extractMetrics` from the response with the `200` status - removed the optional property `items/items/id` from the response with the `200` status - removed the optional property `items/items/ipAllowlistRegex` from the response with the `200` status - removed the optional property `items/items/ipDenylistRegex` from the response with the `200` status - removed the optional property `items/items/keepAliveTimeout` from the response with the `200` status - removed the optional property `items/items/maxActiveReq` from the response with the `200` status - removed the optional property `items/items/maxRequestsPerSocket` from the response with the `200` status - removed the optional property `items/items/metadata` from the response with the `200` status - removed the optional property `items/items/pipeline` from the response with the `200` status - removed the optional property `items/items/pq` from the response with the `200` status - removed the optional property `items/items/pqEnabled` from the response with the `200` status - removed the optional property `items/items/requestTimeout` from the response with the `200` status - removed the optional property `items/items/sendToRoutes` from the response with the `200` status - removed the optional property `items/items/socketTimeout` from the response with the `200` status - removed the optional property `items/items/splunkHecAcks` from the response with the `200` status - removed the optional property `items/items/staleChannelFlushMs` from the response with the `200` status - removed the optional property `items/items/streamtags` from the response with the `200` status - removed the optional property `items/items/tls` from the response with the `200` status - removed the optional property `items/items/useFwdTimezone` from the response with the `200` status - **2025-10-09** `44245bdb7885`: 38 info - added the optional property `items/items/accessControlAllowHeaders` to the response with the `200` status - added the optional property `items/items/accessControlAllowOrigin` to the response with the `200` status - added the optional property `items/items/activityLogSampleRate` to the response with the `200` status - added the optional property `items/items/allowedIndexes` to the response with the `200` status - added the optional property `items/items/authTokens` to the response with the `200` status - added the optional property `items/items/breakerRulesets` to the response with the `200` status - added the optional property `items/items/captureHeaders` to the response with the `200` status - added the optional property `items/items/connections` to the response with the `200` status - added the optional property `items/items/description` to the response with the `200` status - added the optional property `items/items/disabled` to the response with the `200` status - added the optional property `items/items/dropControlFields` to the response with the `200` status - added the optional property `items/items/emitTokenMetrics` to the response with the `200` status - added the optional property `items/items/enableHealthCheck` to the response with the `200` status - added the optional property `items/items/enableProxyHeader` to the response with the `200` status - added the optional property `items/items/environment` to the response with the `200` status - added the optional property `items/items/extractMetrics` to the response with the `200` status - added the optional property `items/items/id` to the response with the `200` status - added the optional property `items/items/ipAllowlistRegex` to the response with the `200` status - added the optional property `items/items/ipDenylistRegex` to the response with the `200` status - added the optional property `items/items/keepAliveTimeout` to the response with the `200` status - added the optional property `items/items/maxActiveReq` to the response with the `200` status - added the optional property `items/items/maxRequestsPerSocket` to the response with the `200` status - added the optional property `items/items/metadata` to the response with the `200` status - added the optional property `items/items/pipeline` to the response with the `200` status - added the optional property `items/items/pq` to the response with the `200` status - added the optional property `items/items/pqEnabled` to the response with the `200` status - added the optional property `items/items/requestTimeout` to the response with the `200` status - added the optional property `items/items/sendToRoutes` to the response with the `200` status - added the optional property `items/items/socketTimeout` to the response with the `200` status - added the optional property `items/items/splunkHecAcks` to the response with the `200` status - added the optional property `items/items/staleChannelFlushMs` to the response with the `200` status - added the optional property `items/items/streamtags` to the response with the `200` status - added the optional property `items/items/tls` to the response with the `200` status - added the optional property `items/items/useFwdTimezone` to the response with the `200` status - added the required property `items/items/host` to the response with the `200` status - added the required property `items/items/port` to the response with the `200` status - added the required property `items/items/splunkHecAPI` to the response with the `200` status - added the required property `items/items/type` to the response with the `200` status - **2025-07-23** `c24493f4f779`: 2 info - api tag `sources` added - api tag `inputs` removed - **2025-07-17** `8ab33f67f808`: 1 info - endpoint added --- [Operation](https://skmtc.dev/criblio/apis/cribl-api-reference/docs/system/inputs/:id/hectoken/:token/patch.md) - [API](https://skmtc.dev/criblio/apis/cribl-api-reference.md) - [Page](https://skmtc.dev/criblio/apis/cribl-api-reference/changes/system/inputs/:id/hectoken/:token/patch)