---
title: "Register a SIEM or SOAR push destination"
method: POST
path: "/v1/siem/configure"
tags: ["Account"]
---

# Register a SIEM or SOAR push destination

`POST /v1/siem/configure`

## Request

- Base URL: `https://api.relayshield.net`
- URL: `https://api.relayshield.net/v1/siem/configure`
- Auth: one of:
  - API key in header `X-RS-API-KEY`
  - HTTP bearer

Free and unmetered. Configure one destination and real-time findings from breach, domain, infostealer, SIM swap, OAuth and dark-web-channel monitoring dispatch to it automatically, with no polling. Send a body with neither `format` nor `url` to disable delivery.

**Billing.** Free. This endpoint is not metered.

**Note.** The destination is keyed on the account email behind your API key, so one destination is held per account, not per key.

## Request body

- object: At least one of: `format`, `url`.
  - `format` 'splunk_hec' | 'cef' | 'xsoar_webhook': Wire format. `splunk_hec` for Splunk HTTP Event Collector, `cef` for QRadar and other CEF consumers, `xsoar_webhook` for Cortex XSOAR's Generic Webhook incident shape.
  - `url` string, uri: Destination URL. Must be http:// or https://.
  - `auth_token` string: Token sent to the destination, e.g. a Splunk HEC token. Optional.
  - `enabled` boolean: Whether delivery is active. Defaults to true.

## Response `200`

Success. `ok` is true and `data` holds the result.

- object
  - `ok` true, required
  - `data` object, required
    - `format` string: The registered format. Absent on a clear.
    - `url` string: The registered URL. Absent on a clear.
    - `enabled` boolean: Whether delivery is active. Absent on a clear.
    - `status` 'registered' | 'cleared': `cleared` when the body carried neither format nor url.

## Other responses

- `400`: `format` is not one of the three supported values, `url` is not an http:// or https:// URL, or the API key has no account email on file.
- `405`: Wrong HTTP method. Every endpoint is POST.
- `500`: Storing the destination failed.

---

[API](https://skmtc.dev/relayshield/apis/relayshield-api.md) · [All operations](https://skmtc.dev/relayshield/apis/relayshield-api/llms.txt) · [OpenAPI document](https://skmtc.dev/relayshield/apis/relayshield-api/revisions/4d4721b936dd?raw)