---
title: "Get sample log generation subscriptions"
method: GET
path: "/api/v2/security_monitoring/sample_log_generation/subscriptions"
tags: ["Security Monitoring"]
---

# Get sample log generation subscriptions

`GET /api/v2/security_monitoring/sample_log_generation/subscriptions`

Get the sample log generation subscriptions for the organization.
Sample log generation injects representative example logs for a given Cloud SIEM content pack into the Logs platform,
which can be used to test detection rules without onboarding the underlying integration first.

**Availability**: this endpoint is restricted to Cloud SIEM trial organizations on an eligible
pricing model. Other organizations receive a `403 Forbidden` (non-trial orgs) or a `400 Bad Request`
(feature disabled), and legacy pricing tiers receive a response with `status: not_available`.

## Query parameters

- `status` 'active' | 'all' — Filter that controls whether to return only active subscriptions or every subscription on record.
- `start_timestamp` string, date-time
- `end_timestamp` string, date-time

## Response `200`

OK

- SampleLogGenerationSubscriptionsResponse — Response containing a list of sample log generation subscriptions.
  - `data` SampleLogGenerationSubscriptionData[], required — The list of sample log generation subscriptions.
    - `attributes` SampleLogGenerationSubscriptionAttributes, required — The attributes describing a sample log generation subscription.
      - `content_pack_id` string, required — The identifier of the Cloud SIEM content pack the subscription targets.
      - `created_at` string, date-time, required — The time at which the subscription was created.
      - `expires_at` string, date-time, required — The time at which the subscription expires and stops generating logs.
      - `is_active` boolean, required — Whether the subscription is currently active and generating logs.
      - `status` 'subscribed' | 'renewed' | 'unsubscribed' | 'no_active_subscription' | 'not_available' | 'active' | 'expired', required — The status of the subscription.
    - `id` string, required — The unique identifier of the subscription.
    - `type` 'subscriptions', required — The type of the resource. The value should always be `subscriptions`.
  - `meta` SampleLogGenerationSubscriptionsResponseMeta, required — Metadata returned alongside a list of sample log generation subscriptions.
    - `total_subscriptions` integer, required — The total number of subscriptions matching the request, irrespective of pagination.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.dev/datadog/apis/api-v2.md) · [All operations](https://skmtc.dev/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)