---
title: "List SIEM destinations"
method: GET
path: "/siem/destinations"
tags: ["SIEM"]
---

# List SIEM destinations

`GET /siem/destinations`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/siem/destinations`
- Auth: API key in header `API-Key`

Returns SIEM destinations configured for the workspace.

Required scope: `siem:read`

## Headers

- `API-Version` '2026-06-01.beta', required

## Response `200`

The request has succeeded.

- SIEMDestination[]
  - `id` string, uuid, required
  - `name` string, required
  - `enabled` boolean, required
  - `type` 'syslog' | 's3' | 'http', required: External SIEM destination type.
  - `source` SIEMSourceConfig, required
    - `type` 'keycloak_events' | 'application_logs' | 'security_logs' | 'skycloak_audit', required: Workspace data stream forwarded to the destination.
    - `cluster_ids` ClusterId[]: Cluster IDs to include. Omit to include all clusters in the workspace.
    - `realms` RealmName[]: Realm names to include. Omit to include all realms in the selected clusters.
    - `keycloak_event_types` string[]: Keycloak event type codes to include. Required when `type` is `keycloak_events`; rejected for other source types.
  - `batch` SIEMBatchConfig, required
    - `max_events` integer
    - `max_interval_seconds` integer
  - `syslog` SIEMSyslogConfig
    - `host` string, required
    - `port` integer, required
    - `protocol` 'udp' | 'tcp' | 'tls', required
    - `format` 'cef' | 'leef' | 'rfc5424' | 'json', required
  - `s3` SIEMS3DestinationConfig
    - `bucket` string, required
    - `region` string, required
    - `prefix` string
    - `auth_type` 'access_key' | 'iam_role' | 'assume_role' | 'irsa', required
    - `role_arn` string
    - `external_id` string
    - `has_access_key_secret` boolean, required
  - `http` SIEMHTTPDestinationConfig
    - `url` string, required
    - `auth_type` 'none' | 'bearer' | 'basic' | 'shared_key', required
    - `header_names` string[], required
    - `has_auth_credentials` boolean, required
    - `workspace_id` string: Azure Log Analytics workspace ID. Present when `auth_type` is `shared_key`.
  - `health_status` 'healthy' | 'degraded' | 'failed', required
  - `failure_count` integer, required
  - `last_error` string
  - `last_sent_at` string, date-time
  - `total_events_sent` integer, required
  - `total_logs_sent` integer, required
  - `total_bytes_sent` integer, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `401`: Access is unauthorized.
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)