---
title: "get gcs source"
method: GET
path: "/log-sources/gcs/{id}"
tags: ["gcs source"]
---

# get gcs source

`GET /log-sources/gcs/{id}`

## Path parameters

- `id` string, required — ID of the GCS source to fetch

## Response `200`

OK response.

- GcsSourceAPIGcsSource
  - `credentials` string — The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.
  - `credentialsType` 'service_account' | 'wif' — The type of credentials being used: service_account or wif (Workload Identity Federation).
  - `gcsBucket` string — The GCS bucket name
  - `integrationId` string — The id of the GCS source
  - `integrationLabel` string — The integration label (name)
  - `logStreamType` 'Auto' | 'JSON' | 'JsonArray' | 'Lines' | 'XML' — The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML
  - `logStreamTypeOptions` GcsSourceAPILogStreamTypeOptions
    - `jsonArrayEnvelopeField` string — Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself
    - `xmlRootElement` string — The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element
  - `prefixLogTypes` GcsSourceAPIPrefixLogTypesMapping[] — Prefix-based log type mappings for parsing ingested data
    - `excludedPrefixes` string[] — Prefixes to exclude from matching. Supports '*' as a wildcard for dynamic path segments.
    - `logTypes` string[] — The log types (schemas) to apply for this prefix
    - `prefix` string — GCS prefix to match. Leave empty to match all files in the bucket.
  - `projectId` string — The GCP project ID. Optional for service_account credentials. Required for WIF.
  - `subscriptionId` string — The GCP Pub/Sub subscription ID used to receive GCS bucket notifications

## Other responses

- `400` — bad_request: Bad Request response.
- `404` — not_found: Not Found response.
- `500` — service: Internal Server Error response.

---

[API](https://skmtc.dev/panther/apis/panther-rest-api.md) · [All operations](https://skmtc.dev/panther/apis/panther-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/panther/panther-rest-api/revisions/eb177cb9d6a1/schema)