---
title: "create s3 source"
method: POST
path: "/log-sources/s3"
tags: ["s3 source"]
---

# create s3 source

`POST /log-sources/s3`

## Request body

- S3SourceAPICreateS3Source
  - `awsAccountId` string, required — The 12-digit AWS account ID where the S3 bucket resides
  - `integrationLabel` string, required — The integration label (name)
  - `kmsKey` string — KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.
  - `logProcessingRole` string, required — The IAM role ARN that Panther assumes to read from the S3 bucket
  - `logStreamType` 'Auto' | 'JSON' | 'JsonArray' | 'Lines' | 'XML' | 'CloudWatchLogs', required — The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs
  - `logStreamTypeOptions` S3SourceAPIS3LogStreamTypeOptions
    - `jsonArrayEnvelopeField` string — Path to the JSON array field to extract records from. Only applicable when logStreamType is JsonArray. Omit if the input is already a top-level array.
    - `retainEnvelopeFields` boolean — Preserve CloudWatch Logs envelope metadata (accountId, logGroup, subscriptionFilters) in a p_header column. Only applicable when logStreamType is CloudWatchLogs.
    - `xmlRootElement` string — Root element wrapping XML events. Only applicable when logStreamType is XML. Omit if events are not enclosed in a root element.
  - `managedBucketNotifications` boolean, required — Whether Panther should configure the S3 bucket notifications automatically
  - `s3Bucket` string, required — The S3 bucket name
  - `s3PrefixLogTypes` S3SourceAPIPrefixLogTypesMapping[], required — Prefix-based log type mappings for parsing ingested data
    - `excludedPrefixes` string[] — Prefixes to exclude from matching. Use '*' as a wildcard for dynamic path segments.
    - `logTypes` string[] — The log types (schemas) to apply for this prefix
    - `prefix` string — S3 prefix to match. Leave empty to match all objects in the bucket.

## Response `201`

Created response.

- S3SourceAPIS3Source
  - `awsAccountId` string — The AWS account ID where the S3 bucket resides
  - `integrationId` string — The unique ID of the S3 log source
  - `integrationLabel` string — The integration label (name)
  - `kmsKey` string — KMS key ARN for server-side encryption. Omit if the bucket is not KMS-encrypted.
  - `logProcessingRole` string — The IAM role ARN that Panther assumes to read from the S3 bucket
  - `logStreamType` 'Auto' | 'JSON' | 'JsonArray' | 'Lines' | 'XML' | 'CloudWatchLogs' — The log stream type. Supported: Auto, JSON, JsonArray, Lines, XML, CloudWatchLogs
  - `logStreamTypeOptions` S3SourceAPIS3LogStreamTypeOptions
    - `jsonArrayEnvelopeField` string — Path to the JSON array field to extract records from. Only applicable when logStreamType is JsonArray. Omit if the input is already a top-level array.
    - `retainEnvelopeFields` boolean — Preserve CloudWatch Logs envelope metadata (accountId, logGroup, subscriptionFilters) in a p_header column. Only applicable when logStreamType is CloudWatchLogs.
    - `xmlRootElement` string — Root element wrapping XML events. Only applicable when logStreamType is XML. Omit if events are not enclosed in a root element.
  - `managedBucketNotifications` boolean — Whether Panther should configure the S3 bucket notifications automatically
  - `s3Bucket` string — The S3 bucket name
  - `s3PrefixLogTypes` S3SourceAPIPrefixLogTypesMapping[] — Prefix-based log type mappings for parsing ingested data
    - `excludedPrefixes` string[] — Prefixes to exclude from matching. Use '*' as a wildcard for dynamic path segments.
    - `logTypes` string[] — The log types (schemas) to apply for this prefix
    - `prefix` string — S3 prefix to match. Leave empty to match all objects in the bucket.

## Other responses

- `400` — bad_request: Bad Request response.
- `409` — exists: Conflict response.
- `500` — service: Internal Server Error response.

---

[API](https://skmtc.dev/panther/apis/panther-rest-api.md) · [All operations](https://skmtc.dev/panther/apis/panther-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/panther/panther-rest-api/revisions/eb177cb9d6a1/schema)