---
title: "Create a Collector"
method: POST
path: "/lib/jobs"
tags: ["collectors"]
---

# Create a Collector

`POST /lib/jobs`

Create a new Collector.

## Request body

- union
  - SavedJobCollection — Configuration for a saved collection job, including Collector, input, and optional run settings.
    - `id` string — Unique ID for this Job
    - `description` string — Description
    - `type` 'collection' | 'executor' | 'scheduledSearch', required — Job type
    - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector.
    - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live.
    - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface.
    - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution
    - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere.
    - `schedule` ScheduleTypeSavedJobResponseCollection — Configuration for a scheduled job
      - `enabled` boolean — Enable to configure scheduling for this Collector
      - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits
      - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules
      - `cronSchedule` string — A cron schedule on which to run this job
      - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time
      - `run` RunSettingsTypeSavedJobResponseCollectionSchedule — Run settings that control how the scheduled job executes, including log level, task sizing, and timeout.
        - `type` 'collection' — Resource type identifier.
        - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors
        - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled
        - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging
        - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time.
        - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job.
        - `timeRangeType` string — Time range
        - `earliest` union — Earliest time to collect data for the selected timezone
          - number
          - string
        - `latest` union — Latest time to collect data for the selected timezone
          - number
          - string
        - `timestampTimezone` string — IANA timezone name for interpreting timestamp values in the collection time range.
        - `timeWarning` TimeWarningTypeRunnableJobCollectionScheduleRun — Warning state used when the collection time range is unset for time-sensitive Collectors.
        - `expression` string — A filter for tokens in the provided collect path and/or the events being collected
        - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task.
        - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks.
    - `streamtags` string[] — Metadata tags used for categorization and filtering.
    - `workerAffinity` boolean — If enabled, tasks are created and run by the same Worker Node
    - `collector` union, required — Collector configuration
      - CollectorAzureBlob — AzureBlob collector configuration
        - `type` 'azure_blob', required — Collector type
        - `conf` union, required — Collector configuration
          - object
            - `outputName` string — An optional predefined Destination that will be used to auto-populate Collector settings
            - `authType` 'manual' — Discriminator value.
            - `containerName` string, required — Container to collect from. This value can be a constant, or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: myBucket-${C.vars.myVar}
            - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
            - `extractors` object[] — Extractors allow use of template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)} will enrich discovery results with a human-readable "date" field.
              - …
            - `recurse` boolean — Recurse through subdirectories
            - `includeMetadata` boolean — Include Azure Blob metadata in collected events. In each event, metadata will be located at: __collectible.metadata.
            - `includeTags` boolean — Include Azure Blob tags in collected events. In each event, tags will be located at: __collectible.tags. Disable this feature when using a Shared Access Signature Connection String, to prevent errors.
            - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk
            - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified.
            - `connectionString` string, required — Enter your Azure storage account Connection String. If left blank, Cribl Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING.
            - `__template_connectionString` string — Binds 'connectionString' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'connectionString' at runtime.
            - `textSecret` string — Text secret
            - `storageAccountName` string — The name of your Azure storage account
            - `__template_storageAccountName` string — Binds 'storageAccountName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'storageAccountName' at runtime.
            - `tenantId` string — The service principal's tenant ID
            - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime.
            - `clientId` string — The service principal's client ID
            - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime.
            - `clientTextSecret` string — Text secret containing the client secret
            - `endpointSuffix` string — The endpoint suffix for the service URL. Takes precedence over the Azure Cloud setting. Defaults to core.windows.net.
            - `__template_endpointSuffix` string — Binds 'endpointSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpointSuffix' at runtime.
            - `azureCloud` string — The Azure cloud to use. Defaults to Azure Public Cloud.
            - `__template_azureCloud` string — Binds 'azureCloud' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'azureCloud' at runtime.
            - `certificate` CertificateTypeAzureBlobAuthTypeClientCert — Certificate credentials for the service principal.
              - …
            - `__template_containerName` string — Binds 'containerName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'containerName' at runtime.
            - `__template_path` string — Binds 'path' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'path' at runtime.
          - object
            - `outputName` string — An optional predefined Destination that will be used to auto-populate Collector settings
            - `authType` 'secret' — Discriminator value.
            - `containerName` string, required — Container to collect from. This value can be a constant, or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: myBucket-${C.vars.myVar}
            - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
            - `extractors` object[] — Extractors allow use of template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)} will enrich discovery results with a human-readable "date" field.
              - …
            - `recurse` boolean — Recurse through subdirectories
            - `includeMetadata` boolean — Include Azure Blob metadata in collected events. In each event, metadata will be located at: __collectible.metadata.
            - `includeTags` boolean — Include Azure Blob tags in collected events. In each event, tags will be located at: __collectible.tags. Disable this feature when using a Shared Access Signature Connection String, to prevent errors.
            - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk
            - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified.
            - `connectionString` string — Enter your Azure storage account Connection String. If left blank, Cribl Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING.
            - `__template_connectionString` string — Binds 'connectionString' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'connectionString' at runtime.
            - `textSecret` string, required — Text secret
            - `storageAccountName` string — The name of your Azure storage account
            - `__template_storageAccountName` string — Binds 'storageAccountName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'storageAccountName' at runtime.
            - `tenantId` string — The service principal's tenant ID
            - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime.
            - `clientId` string — The service principal's client ID
            - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime.
            - `clientTextSecret` string — Text secret containing the client secret
            - `endpointSuffix` string — The endpoint suffix for the service URL. Takes precedence over the Azure Cloud setting. Defaults to core.windows.net.
            - `__template_endpointSuffix` string — Binds 'endpointSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpointSuffix' at runtime.
            - `azureCloud` string — The Azure cloud to use. Defaults to Azure Public Cloud.
            - `__template_azureCloud` string — Binds 'azureCloud' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'azureCloud' at runtime.
            - `certificate` CertificateTypeAzureBlobAuthTypeClientCert — Certificate credentials for the service principal.
              - …
            - `__template_containerName` string — Binds 'containerName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'containerName' at runtime.
            - `__template_path` string — Binds 'path' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'path' at runtime.
          - object
            - `outputName` string — An optional predefined Destination that will be used to auto-populate Collector settings
            - `authType` 'clientSecret' — Discriminator value.
            - `containerName` string, required — Container to collect from. This value can be a constant, or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: myBucket-${C.vars.myVar}
            - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
            - `extractors` object[] — Extractors allow use of template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)} will enrich discovery results with a human-readable "date" field.
              - …
            - `recurse` boolean — Recurse through subdirectories
            - `includeMetadata` boolean — Include Azure Blob metadata in collected events. In each event, metadata will be located at: __collectible.metadata.
            - `includeTags` boolean — Include Azure Blob tags in collected events. In each event, tags will be located at: __collectible.tags. Disable this feature when using a Shared Access Signature Connection String, to prevent errors.
            - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk
            - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified.
            - `connectionString` string — Enter your Azure storage account Connection String. If left blank, Cribl Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING.
            - `__template_connectionString` string — Binds 'connectionString' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'connectionString' at runtime.
            - `textSecret` string — Text secret
            - `storageAccountName` string, required — The name of your Azure storage account
            - `__template_storageAccountName` string — Binds 'storageAccountName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'storageAccountName' at runtime.
            - `tenantId` string, required — The service principal's tenant ID
            - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime.
            - `clientId` string, required — The service principal's client ID
            - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime.
            - `clientTextSecret` string, required — Text secret containing the client secret
            - `endpointSuffix` string — The endpoint suffix for the service URL. Takes precedence over the Azure Cloud setting. Defaults to core.windows.net.
            - `__template_endpointSuffix` string — Binds 'endpointSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpointSuffix' at runtime.
            - `azureCloud` string — The Azure cloud to use. Defaults to Azure Public Cloud.
            - `__template_azureCloud` string — Binds 'azureCloud' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'azureCloud' at runtime.
            - `certificate` CertificateTypeAzureBlobAuthTypeClientCert — Certificate credentials for the service principal.
              - …
            - `__template_containerName` string — Binds 'containerName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'containerName' at runtime.
            - `__template_path` string — Binds 'path' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'path' at runtime.
          - object
            - `outputName` string — An optional predefined Destination that will be used to auto-populate Collector settings
            - `authType` 'clientCert' — Discriminator value.
            - `containerName` string, required — Container to collect from. This value can be a constant, or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: myBucket-${C.vars.myVar}
            - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
            - `extractors` object[] — Extractors allow use of template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)} will enrich discovery results with a human-readable "date" field.
              - …
            - `recurse` boolean — Recurse through subdirectories
            - `includeMetadata` boolean — Include Azure Blob metadata in collected events. In each event, metadata will be located at: __collectible.metadata.
            - `includeTags` boolean — Include Azure Blob tags in collected events. In each event, tags will be located at: __collectible.tags. Disable this feature when using a Shared Access Signature Connection String, to prevent errors.
            - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk
            - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified.
            - `connectionString` string — Enter your Azure storage account Connection String. If left blank, Cribl Stream will fall back to env.AZURE_STORAGE_CONNECTION_STRING.
            - `__template_connectionString` string — Binds 'connectionString' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'connectionString' at runtime.
            - `textSecret` string — Text secret
            - `storageAccountName` string, required — The name of your Azure storage account
            - `__template_storageAccountName` string — Binds 'storageAccountName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'storageAccountName' at runtime.
            - `tenantId` string, required — The service principal's tenant ID
            - `__template_tenantId` string — Binds 'tenantId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tenantId' at runtime.
            - `clientId` string, required — The service principal's client ID
            - `__template_clientId` string — Binds 'clientId' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientId' at runtime.
            - `clientTextSecret` string — Text secret containing the client secret
            - `endpointSuffix` string — The endpoint suffix for the service URL. Takes precedence over the Azure Cloud setting. Defaults to core.windows.net.
            - `__template_endpointSuffix` string — Binds 'endpointSuffix' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpointSuffix' at runtime.
            - `azureCloud` string — The Azure cloud to use. Defaults to Azure Public Cloud.
            - `__template_azureCloud` string — Binds 'azureCloud' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'azureCloud' at runtime.
            - `certificate` CertificateTypeAzureBlobAuthTypeClientCert, required — Certificate credentials for the service principal.
              - …
            - `__template_containerName` string — Binds 'containerName' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'containerName' at runtime.
            - `__template_path` string — Binds 'path' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'path' at runtime.
        - `destructive` boolean — Delete any files collected (where applicable)
        - `encoding` string — Character encoding to use when parsing ingested data.
      - CollectorCriblLake — CriblLake collector configuration
        - `type` 'cribl_lake', required — Collector type
        - `conf` object, required — Collector configuration
          - `storageLocationId` string — Storage location for the Lake Dataset
          - `dataset` string, required — Lake dataset to collect data from.
          - `__template_dataset` string — Binds 'dataset' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'dataset' at runtime.
        - `destructive` boolean — Delete any files collected (where applicable)
        - `encoding` string — Character encoding to use when parsing ingested data.
      - CollectorDatabase — Database collector configuration
        - `type` 'database', required — Collector type
        - `conf` object, required — Collector configuration
          - `connectionId` string, required — Select an existing Connection, or go to Knowledge > Database Connections to add one
          - `query` string, required — An expression that resolves to the query string for selecting data from the database. Has access to the special ${earliest} and ${latest} variables, which will resolve to the Collector run's start and end time.
          - `queryValidationEnabled` boolean — Enforces a basic query validation that allows only a single 'select' statement. Disable for more complex queries or when using semicolons. Caution: Disabling query validation allows DDL and DML statements to be executed, which could be destructive to your database.
          - `defaultBreakers` 'Cribl' — Hidden Default Breakers
          - `__scheduling` object — Internal settings for scheduled execution of this Collector.
            - `stateTracking` object — Settings for tracking collection state between consecutive scheduled executions.
              - …
          - `__template_query` string — Binds 'query' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'query' at runtime.
        - `destructive` boolean — Delete any files collected (where applicable)
        - `encoding` string — Character encoding to use when parsing ingested data.
      - CollectorFilesystem — Filesystem collector configuration
        - `type` 'filesystem', required — Collector type
        - `conf` object, required — Collector configuration
          - `outputName` string — Select a predefined configuration (a Destination) to auto-populate Collector settings
          - `path` string, required — The directory from which to collect data. Templating is supported, such as /myDir/${datacenter}/${host}/${app}/. Time-based tokens are also supported, such as /myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
          - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field.
            - `key` string, required — A token from the template directory, such as epoch
            - `expression` string, required — JavaScript expression that receives token under "value" variable, and evaluates to populate event fields, such as {date: new Date(+value*1000)}
          - `recurse` boolean — Recurse through subdirectories
          - `maxBatchSize` number — Maximum number of metadata files to batch before recording as results
          - `__template_path` string — Binds 'path' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'path' at runtime.
        - `destructive` boolean — Delete any files collected (where applicable)
        - `encoding` string — Character encoding to use when parsing ingested data.
      - CollectorGoogleCloudStorage — GoogleCloudStorage collector configuration
        - `type` 'google_cloud_storage', required — Collector type
        - `conf` union, required — Collector configuration
          - object
            - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings
            - `bucket` string, required — Name of the bucket to collect from. This value can be a constant or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: `myBucket-${C.vars.myVar}`.
            - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are also supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
            - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field.
              - …
            - `endpoint` string — Google Cloud Storage service endpoint. If empty, the endpoint will default to https://storage.googleapis.com.
            - `disableTimeFilter` boolean — Used to disable Collector event time filtering when a date range is specified
            - `recurse` boolean — Recurse through subdirectories
            - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results
            - `authType` 'auto' — Discriminator value.
            - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk
            - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload button at this field's upper right.
            - `textSecret` string — Select or create a stored text secret that references your credentials
            - `__template_bucket` string — Binds 'bucket' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'bucket' at runtime.
            - `__template_path` string — Binds 'path' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'path' at runtime.
            - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime.
          - object
            - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings
            - `bucket` string, required — Name of the bucket to collect from. This value can be a constant or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: `myBucket-${C.vars.myVar}`.
            - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are also supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
            - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field.
              - …
            - `endpoint` string — Google Cloud Storage service endpoint. If empty, the endpoint will default to https://storage.googleapis.com.
            - `disableTimeFilter` boolean — Used to disable Collector event time filtering when a date range is specified
            - `recurse` boolean — Recurse through subdirectories
            - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results
            - `authType` 'manual' — Discriminator value.
            - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk
            - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified.
            - `serviceAccountCredentials` string, required — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload button at this field's upper right.
            - `textSecret` string — Select or create a stored text secret that references your credentials
            - `__template_bucket` string — Binds 'bucket' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'bucket' at runtime.
            - `__template_path` string — Binds 'path' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'path' at runtime.
            - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime.
          - object
            - `outputName` string — Name of the predefined Destination that will be used to auto-populate Collector settings
            - `bucket` string, required — Name of the bucket to collect from. This value can be a constant or a JavaScript expression that can only be evaluated at init time. Example referencing a Global Variable: `myBucket-${C.vars.myVar}`.
            - `path` string — The directory from which to collect data. Templating is supported, such as myDir/${datacenter}/${host}/${app}/. Time-based tokens are also supported, such as myOtherDir/${_time:%Y}/${_time:%m}/${_time:%d}/.
            - `extractors` object[] — Allows using template tokens as context for expressions that enrich discovery results. For example, given a template /path/${epoch}, an extractor under key "epoch" with an expression {date: new Date(+value*1000)}, will enrich discovery results with a human readable "date" field.
              - …
            - `endpoint` string — Google Cloud Storage service endpoint. If empty, the endpoint will default to https://storage.googleapis.com.
            - `disableTimeFilter` boolean — Used to disable Collector event time filtering when a date range is specified
            - `recurse` boolean — Recurse through subdirectories
            - `maxBatchSize` number — Maximum number of metadata objects to batch before recording as results
            - `authType` 'secret' — Discriminator value.
            - `parquetChunkSizeMB` number — Maximum file size for each Parquet chunk
            - `parquetChunkDownloadTimeout` number — The maximum time allowed for downloading a Parquet chunk. Processing will abort if a chunk cannot be downloaded within the time specified.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload button at this field's upper right.
            - `textSecret` string, required — Select or create a stored text secret that references your credentials
            - `__template_bucket` string — Binds 'bucket' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'bucket' at runtime.
            - `__template_path` string — Binds 'path' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'path' at runtime.
            - `__template_endpoint` string — Binds 'endpoint' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'endpoint' at runtime.
        - `destructive` boolean — Delete any files collected (where applicable)
        - `encoding` string — Character encoding to use when parsing ingested data.
      - CollectorHealthCheck — HealthCheck collector configuration
        - `type` 'health_check', required — Collector type
        - `conf` union, required
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'none', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` object[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'basic', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string, required — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string, required — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` object[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'basicSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string, required — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` object[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'login', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string, required — Login username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string, required — Login password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` object[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'loginSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials
            - `loginUrl` string, required — URL to use for login API call, this call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. If left blank, the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` object[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'oauth', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` object[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` object[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'oauthSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` object[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` object[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string, required — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` object[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'none', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfHealthCheckCollectMethodPost[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'basic', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string, required — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string, required — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfHealthCheckCollectMethodPost[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'basicSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string, required — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfHealthCheckCollectMethodPost[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'login', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string, required — Login username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string, required — Login password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfHealthCheckCollectMethodPost[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'loginSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials
            - `loginUrl` string, required — URL to use for login API call, this call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. If left blank, the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfHealthCheckCollectMethodPost[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'oauth', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` object[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfHealthCheckCollectMethodPost[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'oauthSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` object[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` object[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string, required — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfHealthCheckCollectMethodPost[] — Optional health check request parameters.
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post_with_body', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'none', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}.
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post_with_body', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'basic', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string, required — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string, required — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}.
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post_with_body', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'basicSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string, required — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}.
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post_with_body', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'login', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string, required — Login username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string, required — Login password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}.
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post_with_body', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'loginSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials
            - `loginUrl` string, required — URL to use for login API call, this call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string, required — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. If left blank, the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` AuthRequestHeaderConfHealthCheckAuthenticationLogin[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}.
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post_with_body', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'oauth', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` object[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}.
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — Expression to derive URL to use for the health check operation (can be a constant).
            - `collectMethod` 'post_with_body', required — Discriminator value.
            - `collectRequestHeaders` object[] — Optional health check request headers.
              - …
            - `authenticateCollect` boolean — Enable to make auth health check call.
            - `authentication` 'oauthSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout, use 0 to disable
            - `rejectUnauthorized` boolean — Whether to reject certificates that cannot be verified against a valid CA (e.g., self-signed certificates).
            - `defaultBreakers` 'Cribl' — Hidden Default Breakers
            - `safeHeaders` string[] — List of headers that are safe to log in plain text.
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `username` string — Basic authentication username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Basic authentication password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request, ${username} and ${password} are used to specify location of these attributes in the message
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `__template_tokenRespAttribute` string — Binds 'tokenRespAttribute' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'tokenRespAttribute' at runtime.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in discover and collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` object[] — Optional authentication request headers.
              - …
            - `clientSecretParamName` string, required — Parameter name that contains client secret. Defaults to 'client_secret', and is automatically added to request parameters.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Stored on disk encrypted, and is automatically added to request parameters
            - `authRequestParams` AuthRequestParamConfHealthCheckAuthenticationOauth[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` object[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string, required — Select or create a text secret that contains the client secret's value.
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectBody` string — Template for POST body to send with the health check request. You can reference parameters from the Discover response, using template params of the form: ${variable}.
        - `destructive` boolean — Delete any files collected (where applicable)
        - `encoding` string — Character encoding to use when parsing ingested data.
      - CollectorRest — Rest collector configuration
        - `type` 'rest', required — Collector type
        - `conf` union, required
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'none', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'basic', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string, required — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string, required — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'basicSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string, required — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'login', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string, required — Login username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string, required — Login password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string, required — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'loginSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials
            - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'oauth', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'oauthSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` object[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string, required — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'google_oauth', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string, required — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'google_oauthSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string, required — Select or create a text secret that contains the Google service account credentials value
            - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'get', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'hmac', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string, required — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'none', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'basic', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string, required — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string, required — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'basicSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string, required — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'login', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string, required — Login username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string, required — Login password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string, required — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'loginSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string, required — Select or create a stored secret that references your login credentials
            - `loginUrl` string, required — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string, required — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'oauth', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string, required — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'oauthSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string, required — URL to use for the OAuth API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string, required — JavaScript expression to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string, required — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` object[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string, required — Select or create a text secret that contains the client secret's value
            - `scopes` string[] — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'google_oauth', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string — Select or create a text secret that contains the client secret's value
            - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string, required — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'google_oauthSecret', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
            - `stopOnEmptyResults` boolean — Stop pagination when the Event Breaker produces no events
            - `safeHeaders` string[] — List of headers that are safe to log in plain text
            - `retryRules` union — Settings that control how the Collector retries failed HTTP requests.
              - …
            - `microsoftGraphDelta` object — Internal opt-in for the Microsoft Graph deltaLink state-tracking hook. Set programmatically by the Microsoft Graph source when the configured URL targets a /delta endpoint; not user-configurable.
              - …
            - `__scheduling` object — Internal settings for scheduled execution of this Collector.
              - …
            - `username` string — Username
            - `__template_username` string — Binds 'username' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'username' at runtime.
            - `password` string — Password
            - `__template_password` string — Binds 'password' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'password' at runtime.
            - `credentialsSecret` string — Select or create a stored secret that references your credentials
            - `loginUrl` string — URL to use for login API call. This call is expected to be a POST.
            - `__template_loginUrl` string — Binds 'loginUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'loginUrl' at runtime.
            - `loginBody` string — Template for POST body to send with login request. ${username} and ${password} are used to specify location of these attributes in the message. For x-www-form-urlencoded bodies, wrap values with ${C.Encode.uri(password)} to preserve special characters like +, &, and =.
            - `getAuthTokenFromHeader` boolean — Extract the auth token from the HTTP 'Authorization' response header instead of the standard JSON body of the login response
            - `authHeaderKey` string — Authorization header key to pass in Discover and Collect calls. Defaults to the literal name 'Authorization'.
            - `authHeaderExpr` string — JavaScript expression used to compute the Authorization header to pass in Discover and Collect calls. The value ${token} is used to reference the token obtained from login.
            - `authRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Authentication headers
              - …
            - `tokenRespAttribute` string — Path to token attribute in login response body. Nested attributes are OK. Leave blank if the response content type is text/plain; the entire response body will be used to derive the authorization header.
            - `clientSecretParamName` string — Defaults to 'client_secret'. Automatically added to request parameters using the value specified.
            - `clientSecretParamValue` string — Secret value to add to HTTP requests as the 'client secret' parameter. Value is stored encrypted on disk and automatically added to request parameters.
            - `__template_clientSecretParamValue` string — Binds 'clientSecretParamValue' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'clientSecretParamValue' at runtime.
            - `authRequestParams` CollectRequestParamConfRestCollectMethodGet[] — OAuth request parameters added to the POST body. The Content-Type header will automatically be set to application/x-www-form-urlencoded.
              - …
            - `refreshTokenField` string — Field name in the token response that contains a refresh token (example: 'refresh_token'). When set, the Collector uses the refresh token to obtain new access tokens without re-sending credentials.
            - `rotateRefreshToken` boolean — The Collector will update its stored value on each successful refresh. Enable if the server issues a new refresh token on every use.
            - `refreshUrl` string — Override the refresh endpoint URL if it differs from the Login URL. Defaults to Login URL.
            - `__template_refreshUrl` string — Binds 'refreshUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'refreshUrl' at runtime.
            - `refreshRequestParams` RefreshRequestParamConfHealthCheckAuthenticationOauth[] — Parameters to include in the refresh token request body. Most servers require 'client_id' here. If not set, the Collector sends only grant_type, refresh_token, and client_secret.
              - …
            - `textSecret` string, required — Select or create a text secret that contains the Google service account credentials value
            - `scopes` string[], required — Scopes to use during authentication. See [Google's docs](https://developers.google.com/identity/protocols/oauth2/scopes) for more information.
            - `serviceAccountCredentials` string — Contents of Google Cloud service account credentials (JSON keys) file. To upload a file, click the upload icon in this field's upper right.
            - `__template_serviceAccountCredentials` string — Binds 'serviceAccountCredentials' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'serviceAccountCredentials' at runtime.
            - `subject` string, required — Email address of a user account with Super Admin permissions to the resources the collector will retrieve
            - `__template_subject` string — Binds 'subject' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'subject' at runtime.
            - `hmacFunctionId` string — Select or create an HMAC Function to use with authentication
            - `__template_collectUrl` string — Binds 'collectUrl' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'collectUrl' at runtime.
            - `collectRequestParams` CollectRequestParamConfRestCollectMethodGet[] — Collect parameters
              - …
          - object — Collector configuration
            - `discovery` union — Settings that control how the Collector discovers Collect tasks.
              - …
            - `collectUrl` string, required — URL (constant or JavaScript expression) to use for the Collect operation
            - `collectMethod` 'post', required — Discriminator value.
            - `collectRequestHeaders` CollectRequestParamConfRestCollectMethodGet[] — Headers to send with each Collect request.
              - …
            - `pagination` union — Settings that control how the Collector paginates through Collect results.
              - …
            - `authentication` 'hmac', required — Discriminator value.
            - `timeout` number — HTTP request inactivity timeout. Use 0 to disable.
            - `maxResponseBodySize` string — Maximum amount of data to buffer from a single response body. Responses exceeding this limit will be rejected. Maximum allowed value is 512 MB. Leave unset to rely on default error handling.
            - `useRoundRobinDns` boolean — Use round-robin DNS lookup. Suitable when DNS server returns multiple addresses in sort order.
            - `disableTimeFilter` boolean — Disable Collector event time filtering when a date range is specified
            - `decodeUrl` boolean — Decode the URL before sending requests (including pagination requests)
            - `rejectUnauthorized` boolean — Reject certificates that cannot be verified against a valid CA (such as self-signed certificates)
            - `captureHeaders` boolean — Enable to add response headers to the resHeaders field under the __collectible object
- … truncated; see the full OpenAPI document linked below

## Response `200`

The created Collector in a response envelope with <code>count</code> and <code>items</code>.

- CountedSavedJobResponse
  - `count` integer, required — number of items present in the items array
  - `items` SavedJobResponse[], required — List of items in this response.
    - union
      - object — Configuration for a saved collection job, including Collector, input, and optional run settings.
        - `savedState` object — Runtime collection state.
        - `notifications` Notification[] — Notification targets.
          - union
            - object
              - …
            - object
              - …
            - object
              - …
        - `id` string — Unique ID for this Job
        - `description` string — Description
        - `type` 'collection' | 'executor' | 'scheduledSearch', required — Job type
        - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector.
        - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live.
        - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface.
        - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution
        - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere.
        - `schedule` ScheduleTypeSavedJobResponseCollection — Configuration for a scheduled job
          - `enabled` boolean — Enable to configure scheduling for this Collector
          - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits
          - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules
          - `cronSchedule` string — A cron schedule on which to run this job
          - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time
          - `run` RunSettingsTypeSavedJobResponseCollectionSchedule — Run settings that control how the scheduled job executes, including log level, task sizing, and timeout.
            - `type` 'collection' — Resource type identifier.
            - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors
            - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled
            - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging
            - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time.
            - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job.
            - `timeRangeType` string — Time range
            - `earliest` union — Earliest time to collect data for the selected timezone
              - …
            - `latest` union — Latest time to collect data for the selected timezone
              - …
            - `timestampTimezone` string — IANA timezone name for interpreting timestamp values in the collection time range.
            - `timeWarning` TimeWarningTypeRunnableJobCollectionScheduleRun — Warning state used when the collection time range is unset for time-sensitive Collectors.
            - `expression` string — A filter for tokens in the provided collect path and/or the events being collected
            - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task.
            - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks.
        - `streamtags` string[] — Metadata tags used for categorization and filtering.
        - `workerAffinity` boolean — If enabled, tasks are created and run by the same Worker Node
        - `collector` union, required — Collector configuration
          - CollectorAzureBlob — AzureBlob collector configuration
            - `type` 'azure_blob', required — Collector type
            - `conf` union, required — Collector configuration
              - …
            - `destructive` boolean — Delete any files collected (where applicable)
            - `encoding` string — Character encoding to use when parsing ingested data.
          - CollectorCriblLake — CriblLake collector configuration
            - `type` 'cribl_lake', required — Collector type
            - `conf` object, required — Collector configuration
              - …
            - `destructive` boolean — Delete any files collected (where applicable)
            - `encoding` string — Character encoding to use when parsing ingested data.
          - CollectorDatabase — Database collector configuration
            - `type` 'database', required — Collector type
            - `conf` object, required — Collector configuration
              - …
            - `destructive` boolean — Delete any files collected (where applicable)
            - `encoding` string — Character encoding to use when parsing ingested data.
          - CollectorFilesystem — Filesystem collector configuration
            - `type` 'filesystem', required — Collector type
            - `conf` object, required — Collector configuration
              - …
            - `destructive` boolean — Delete any files collected (where applicable)
            - `encoding` string — Character encoding to use when parsing ingested data.
          - CollectorGoogleCloudStorage — GoogleCloudStorage collector configuration
            - `type` 'google_cloud_storage', required — Collector type
            - `conf` union, required — Collector configuration
              - …
            - `destructive` boolean — Delete any files collected (where applicable)
            - `encoding` string — Character encoding to use when parsing ingested data.
          - CollectorHealthCheck — HealthCheck collector configuration
            - `type` 'health_check', required — Collector type
            - `conf` union, required
              - …
            - `destructive` boolean — Delete any files collected (where applicable)
            - `encoding` string — Character encoding to use when parsing ingested data.
          - CollectorRest — Rest collector configuration
            - `type` 'rest', required — Collector type
            - `conf` union, required
              - …
            - `destructive` boolean — Delete any files collected (where applicable)
            - `encoding` string — Character encoding to use when parsing ingested data.
          - CollectorS3 — S3 collector configuration
            - `type` 's3', required — Collector type
            - `conf` union, required
              - …
            - `destructive` boolean — Delete any files collected (where applicable)
            - `encoding` string — Character encoding to use when parsing ingested data.
          - CollectorScript — Script collector configuration
            - `type` 'script', required — Collector type
            - `conf` object, required — Collector configuration
              - …
            - `destructive` boolean — Delete any files collected (where applicable)
            - `encoding` string — Character encoding to use when parsing ingested data.
          - CollectorSplunk — Splunk collector configuration
            - `type` 'splunk', required — Collector type
            - `conf` union, required — Collector configuration
              - …
            - `destructive` boolean — Delete any files collected (where applicable)
            - `encoding` string — Character encoding to use when parsing ingested data.
        - `input` InputTypeRunnableJobCollection — Input settings for a collection job, including event breaking, routing, and preprocessing options.
          - `type` 'collection' — Resource type identifier.
          - `breakerRulesets` string[] — A list of event-breaking rulesets that will be applied, in order, to the input data stream
          - `staleChannelFlushMs` number — How long (in milliseconds) the Event Breaker will wait for new data to be sent to a specific channel before flushing the data stream out, as is, to the Pipelines
          - `sendToRoutes` boolean — Send events to normal routing and event processing. Disable to select a specific Pipeline/Destination combination.
          - `preprocess` PreprocessType — Optional preprocessing step that pipes collected data through an external command before ingestion.
            - `disabled` boolean, required — Disabled
            - `command` string — Command to feed the data through (via stdin) and process its output (stdout)
            - `args` string[] — Arguments to be added to the custom command
          - `throttleRatePerSec` string — Rate (in bytes per second) to throttle while writing to an output. Accepts values with multiple-byte units, such as KB, MB, and GB. (Example: 42 MB) Default value of 0 specifies no throttling.
          - `metadata` MetadataConfInputCollection[] — Fields to add to events from this input
            - `name` string, required — Name of the metadata field.
            - `value` string, required — JavaScript expression to compute field's value, enclosed in quotes or backticks. (Can evaluate to a constant.)
          - `pipeline` string — Pipeline to process results
          - `output` string — Destination to send results to
        - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime.
      - object — Configuration for a saved executor job, including executor type and run settings.
        - `savedState` object — Runtime collection state.
        - `notifications` Notification[] — Notification targets.
          - union
            - object
              - …
            - object
              - …
            - object
              - …
        - `id` string — Unique ID for this Job
        - `description` string — Description
        - `type` 'collection' | 'executor' | 'scheduledSearch', required — Job type
        - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector.
        - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live.
        - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface.
        - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution
        - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere.
        - `schedule` ScheduleTypeSavedJobResponseCollection — Configuration for a scheduled job
          - `enabled` boolean — Enable to configure scheduling for this Collector
          - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits
          - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules
          - `cronSchedule` string — A cron schedule on which to run this job
          - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time
          - `run` RunSettingsTypeSavedJobResponseCollectionSchedule — Run settings that control how the scheduled job executes, including log level, task sizing, and timeout.
            - `type` 'collection' — Resource type identifier.
            - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors
            - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled
            - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging
            - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time.
            - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job.
            - `timeRangeType` string — Time range
            - `earliest` union — Earliest time to collect data for the selected timezone
              - …
            - `latest` union — Latest time to collect data for the selected timezone
              - …
            - `timestampTimezone` string — IANA timezone name for interpreting timestamp values in the collection time range.
            - `timeWarning` TimeWarningTypeRunnableJobCollectionScheduleRun — Warning state used when the collection time range is unset for time-sensitive Collectors.
            - `expression` string — A filter for tokens in the provided collect path and/or the events being collected
            - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task.
            - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks.
        - `streamtags` string[] — Metadata tags used for categorization and filtering.
        - `executor` ExecutorTypeRunnableJobExecutor, required — Executor configuration, including the executor type and its settings.
          - `type` string, required — The type of executor to run
          - `storeTaskResults` boolean — Determines whether or not to write task results to disk
          - `conf` ExecutorSpecificSettingsTypeRunnableJobExecutorExecutor — Executor-type-specific settings object. Shape varies by executor type.
        - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime.
      - object — Configuration for a saved scheduled search job, including the search query to run.
        - `savedState` object — Runtime collection state.
        - `notifications` Notification[] — Notification targets.
          - union
            - object
              - …
            - object
              - …
            - object
              - …
        - `id` string — Unique ID for this Job
        - `description` string — Description
        - `type` 'collection' | 'executor' | 'scheduledSearch', required — Job type
        - `ttl` string — Time to keep the job's artifacts on disk after job completion. This also affects how long a job is listed in the Job Inspector.
        - `ignoreGroupJobsLimit` boolean — When enabled, this job's artifacts are not counted toward the Worker Group's finished job artifacts limit. Artifacts will be removed only after the Collector's configured time to live.
        - `removeFields` string[] — List of fields to remove from Discover results. Wildcards (for example, aws*) are allowed. This is useful when discovery returns sensitive fields that should not be exposed in the Jobs user interface.
        - `resumeOnBoot` boolean — Resume the ad hoc job if a failure condition causes Stream to restart during job execution
        - `environment` string — Optionally, enable this config only on a specified Git branch. If empty, will be enabled everywhere.
        - `schedule` ScheduleTypeSavedJobResponseCollection — Configuration for a scheduled job
          - `enabled` boolean — Enable to configure scheduling for this Collector
          - `skippable` boolean — Skippable jobs can be delayed, up to their next run time, if the system is hitting concurrency limits
          - `resumeMissed` boolean — If Stream Leader (or single instance) restarts, run all missed jobs according to their original schedules
          - `cronSchedule` string — A cron schedule on which to run this job
          - `maxConcurrentRuns` number — The maximum number of instances of this scheduled job that may be running at any time
          - `run` RunSettingsTypeSavedJobResponseCollectionSchedule — Run settings that control how the scheduled job executes, including log level, task sizing, and timeout.
            - `type` 'collection' — Resource type identifier.
            - `rescheduleDroppedTasks` boolean — Reschedule tasks that failed with non-fatal errors
            - `maxTaskReschedule` number — Maximum number of times a task can be rescheduled
            - `logLevel` 'error' | 'warn' | 'info' | 'debug' | 'silly' — Level at which to set task logging
            - `jobTimeout` string — Maximum time the job is allowed to run. Time unit defaults to seconds if not specified (examples: 30, 45s, 15m). Enter 0 for unlimited time.
            - `mode` string, required — Job run mode. Preview will either return up to N matching results, or will run until capture time T is reached. Discovery will gather the list of files to turn into streaming tasks, without running the data collection job. Full Run will run the collection job.
            - `timeRangeType` string — Time range
            - `earliest` union — Earliest time to collect data for the selected timezone
              - …
            - `latest` union — Latest time to collect data for the selected timezone
              - …
            - `timestampTimezone` string — IANA timezone name for interpreting timestamp values in the collection time range.
            - `timeWarning` TimeWarningTypeRunnableJobCollectionScheduleRun — Warning state used when the collection time range is unset for time-sensitive Collectors.
            - `expression` string — A filter for tokens in the provided collect path and/or the events being collected
            - `minTaskSize` string — Limits the bundle size for small tasks. For example, if your lower bundle size is 1MB, you can bundle up to five 200KB files into one task.
            - `maxTaskSize` string — Limits the bundle size for files above the lower task bundle size. For example, if your upper bundle size is 10MB, you can bundle up to five 2MB files into one task. Files greater than this size will be assigned to individual tasks.
        - `streamtags` string[] — Metadata tags used for categorization and filtering.
        - `savedQueryId` string, required — Identifies which search query to run
        - `__template_streamtags` string — Binds 'streamtags' to a variable for dynamic value resolution. Set to variable ID (pack-scoped) or 'cribl.'/'edge.' prefixed ID (group-scoped). Variable value overrides 'streamtags' at runtime.

## Other responses

- `401` — Authentication failed (missing or invalid credentials or Bearer token).
- `500` — Unexpected server error.

---

[API](https://skmtc.dev/criblio/apis/cribl-api-reference.md) · [All operations](https://skmtc.dev/criblio/apis/cribl-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/criblio/cribl-api-reference/revisions/56cb25079271/schema)