--- title: "Create Security Event Destination" method: POST path: "/security-event-destination" tags: ["Security Event Destination"] --- # Create Security Event Destination `POST /security-event-destination` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-event-destination` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to create a new Security Event Destination ## Request body - object - `data` SecurityEventDestinationCreateSchema, required: Create schema for SecurityEventDestination model. Create - `projectId` string, uuid: ID of the project whose events are sent. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `name` string, required: Friendly name for this destination. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `description` string: What this destination is for. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `provider` 'google-secops' | 'splunk' | 'microsoft-sentinel' | 'elastic-security', required: Which SIEM this destination sends to, e.g. 'google-secops'. Fixed once created. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `config` object: Provider-specific settings that are not secret, such as the region and the instance. Keys are defined by the provider catalog. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `secrets` string, password, required: Provider-specific secrets, such as a service account key, as a JSON object. Encrypted at rest and never returned by the API. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [No access - you don't have permission for this operation], Update: [Project Owner, Project Admin, Security Admin] - `isEnabled` boolean: Whether events are sent to this destination. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `sendScope` 'detections' | 'all-events': 'detections' sends what OneUptime found (its detection rules' and threat intel's matches and imported alerts); 'all-events' sends every security event. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] ## Response `201` Created successfully - object - `data` SecurityEventDestinationReadSchema: Read schema for SecurityEventDestination model. Read - `_id` string, uuid: ID of this object. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `projectId` string, uuid: ID of the project whose events are sent. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `name` string, required: Friendly name for this destination. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `description` string: What this destination is for. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `provider` 'google-secops' | 'splunk' | 'microsoft-sentinel' | 'elastic-security', required: Which SIEM this destination sends to, e.g. 'google-secops'. Fixed once created. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `config` object: Provider-specific settings that are not secret, such as the region and the instance. Keys are defined by the provider catalog. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `isEnabled` boolean: Whether events are sent to this destination. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `sendScope` 'detections' | 'all-events': 'detections' sends what OneUptime found (its detection rules' and threat intel's matches and imported alerts); 'all-events' sends every security event. Permissions - Create: [Project Owner, Project Admin, Security Admin], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [Project Owner, Project Admin, Security Admin] - `cursor` string: The time up to which events have been sent, as an ISO string: the end of the last window delivered. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `lastAttemptAt` object: When OneUptime last tried to send to this destination. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `lastSentAt` object: When events were last delivered to this destination. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `lastSendResult` object: What the last attempt sent: events delivered, events the SIEM refused, and the window they came from. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `lastError` string: Why the last attempt failed, with credentials redacted, if it did. Cleared by the next attempt that succeeds. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `createdByUserId` string, uuid: ID of the user who created this destination. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the user who deleted this destination. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer], Update: [No access - you don't have permission for this operation] ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)