---
title: "Get sample log generation subscriptions"
method: GET
path: "/api/v2/security_monitoring/sample_log_generation/subscriptions"
tags: ["Security Monitoring"]
---

# Get sample log generation subscriptions

`GET /api/v2/security_monitoring/sample_log_generation/subscriptions`

## Request

- Base URL: `https://api.datadoghq.com`
- URL: `https://api.datadoghq.com/api/v2/security_monitoring/sample_log_generation/subscriptions`
- Auth: one of:
  - API key in header `DD-API-KEY` and API key in header `DD-APPLICATION-KEY`
  - OAuth 2
    - Authorization code: `/oauth2/v1/authorize`
    - Token URL: `/oauth2/v1/token` scopes: `security_monitoring_filters_read`, `logs_read_index_data`

Get the sample log generation subscriptions for the organization.
Sample log generation injects representative example logs for a given Cloud SIEM content pack into the Logs platform,
which can be used to test detection rules without onboarding the underlying integration first.

**Availability**: this endpoint is restricted to Cloud SIEM trial organizations on an eligible
pricing model. Other organizations receive a `403 Forbidden` (non-trial orgs) or a `400 Bad Request`
(feature disabled), and legacy pricing tiers receive a response with `status: not_available`.

## Query parameters

- `status` 'active' | 'all': Filter that controls whether to return only active subscriptions or every subscription on record.
- `start_timestamp` string, date-time
- `end_timestamp` string, date-time

## Response `200`

OK

- SampleLogGenerationSubscriptionsResponse: Response containing a list of sample log generation subscriptions.
  - `data` SampleLogGenerationSubscriptionData[], required: The list of sample log generation subscriptions.
    - `attributes` SampleLogGenerationSubscriptionAttributes, required: The attributes describing a sample log generation subscription.
      - `content_pack_id` string, required: The identifier of the Cloud SIEM content pack the subscription targets.
      - `created_at` string, date-time, required: The time at which the subscription was created.
      - `expires_at` string, date-time, required: The time at which the subscription expires and stops generating logs.
      - `is_active` boolean, required: Whether the subscription is currently active and generating logs.
      - `status` 'subscribed' | 'renewed' | 'unsubscribed' | 'no_active_subscription' | 'not_available' | 'active' | 'expired', required: The status of the subscription.
    - `id` string, required: The unique identifier of the subscription.
    - `type` 'subscriptions', required: The type of the resource. The value should always be `subscriptions`.
  - `meta` SampleLogGenerationSubscriptionsResponseMeta, required: Metadata returned alongside a list of sample log generation subscriptions.
    - `total_subscriptions` integer, required: The total number of subscriptions matching the request, irrespective of pagination.

## Other responses

- `400`: Bad Request
- `403`: Not Authorized
- `429`: Too many requests

---

[API](https://skmtc.dev/datadog/apis/datadog-api-v2-collection.md) - [All operations](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/llms.txt) - [OpenAPI document](https://skmtc.dev/datadog/apis/datadog-api-v2-collection/revisions/da68bf029e4c?raw)