---
title: "Create a SIEM destination"
method: POST
path: "/siem/destinations"
tags: ["SIEM"]
---

# Create a SIEM destination

`POST /siem/destinations`

## Request

- Base URL: `http://localhost:8000`
- URL: `http://localhost:8000/siem/destinations`
- Auth: API key in header `API-Key`

Creates a SIEM destination for the workspace. Credentials are write-only and are never returned.

Required scope: `siem:write`

## Headers

- `API-Version` '2026-06-01.beta', required

## Request body

- CreateSIEMDestinationRequest
  - `name` string, required
  - `enabled` boolean
  - `type` 'syslog' | 's3' | 'http', required: External SIEM destination type.
  - `source` SIEMSourceConfig, required
    - `type` 'keycloak_events' | 'application_logs' | 'security_logs' | 'skycloak_audit', required: Workspace data stream forwarded to the destination.
    - `cluster_ids` ClusterId[]: Cluster IDs to include. Omit to include all clusters in the workspace.
    - `realms` RealmName[]: Realm names to include. Omit to include all realms in the selected clusters.
    - `keycloak_event_types` string[]: Keycloak event type codes to include. Required when `type` is `keycloak_events`; rejected for other source types.
  - `batch` SIEMBatchConfig
    - `max_events` integer
    - `max_interval_seconds` integer
  - `syslog` SIEMSyslogConfig
    - `host` string, required
    - `port` integer, required
    - `protocol` 'udp' | 'tcp' | 'tls', required
    - `format` 'cef' | 'leef' | 'rfc5424' | 'json', required
  - `s3` SIEMS3Config
    - `bucket` string, required
    - `region` string, required
    - `prefix` string
    - `auth_type` 'access_key' | 'iam_role' | 'assume_role' | 'irsa', required
    - `access_key_id` string, password: Required when `auth_type` is `access_key`. Write-only.
    - `secret_access_key` string, password: Required when `auth_type` is `access_key`. Write-only.
    - `role_arn` string: Required when `auth_type` is `assume_role`.
    - `external_id` string
  - `http` SIEMHTTPConfig
    - `url` string, uri, required: Webhook endpoint that receives the exported events. Must be a complete `https://` URL with a host; plain `http://` endpoints and characters that are illegal in a URI (`<`, `>`, `"`, spaces) are rejected on create and update.
    - `headers` object: Optional HTTP headers to include in the request. Every value must be a string, a non-string value (boolean, number, object or array) is rejected. Values are write-only and are never returned.
    - `auth_type` 'none' | 'bearer' | 'basic' | 'shared_key', required
    - `bearer_token` string, password: Required when `auth_type` is `bearer`. Write-only. The token is sent verbatim as an `Authorization: Bearer` header value, so it is limited to RFC 6750 token68 characters (letters, digits and `-._~+/=`) and 4096 characters. A token outside that set is rejected with a 422 validation error.
    - `username` string: Required when `auth_type` is `basic`. Write-only.
    - `password` string, password: Required when `auth_type` is `basic`. Write-only.
    - `workspace_id` string: Azure Log Analytics workspace ID. Required when `auth_type` is `shared_key`.
    - `shared_key` string, password: Base64-encoded Azure Log Analytics primary or secondary key. Required when `auth_type` is `shared_key`. Write-only.

## Response `201`

The request has succeeded and a new resource has been created as a result.

- SIEMDestination: Saved SIEM forwarding destination for a workspace.
  - `id` string, uuid, required
  - `name` string, required
  - `enabled` boolean, required
  - `type` 'syslog' | 's3' | 'http', required: External SIEM destination type.
  - `source` SIEMSourceConfig, required
    - `type` 'keycloak_events' | 'application_logs' | 'security_logs' | 'skycloak_audit', required: Workspace data stream forwarded to the destination.
    - `cluster_ids` ClusterId[]: Cluster IDs to include. Omit to include all clusters in the workspace.
    - `realms` RealmName[]: Realm names to include. Omit to include all realms in the selected clusters.
    - `keycloak_event_types` string[]: Keycloak event type codes to include. Required when `type` is `keycloak_events`; rejected for other source types.
  - `batch` SIEMBatchConfig, required
    - `max_events` integer
    - `max_interval_seconds` integer
  - `syslog` SIEMSyslogConfig
    - `host` string, required
    - `port` integer, required
    - `protocol` 'udp' | 'tcp' | 'tls', required
    - `format` 'cef' | 'leef' | 'rfc5424' | 'json', required
  - `s3` SIEMS3DestinationConfig
    - `bucket` string, required
    - `region` string, required
    - `prefix` string
    - `auth_type` 'access_key' | 'iam_role' | 'assume_role' | 'irsa', required
    - `role_arn` string
    - `external_id` string
    - `has_access_key_secret` boolean, required
  - `http` SIEMHTTPDestinationConfig
    - `url` string, required
    - `auth_type` 'none' | 'bearer' | 'basic' | 'shared_key', required
    - `header_names` string[], required
    - `has_auth_credentials` boolean, required
    - `workspace_id` string: Azure Log Analytics workspace ID. Present when `auth_type` is `shared_key`.
  - `health_status` 'healthy' | 'degraded' | 'failed', required
  - `failure_count` integer, required
  - `last_error` string
  - `last_sent_at` string, date-time
  - `total_events_sent` integer, required
  - `total_logs_sent` integer, required
  - `total_bytes_sent` integer, required
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `400`: The server could not understand the request due to invalid syntax.
- `401`: Access is unauthorized.
- `402`: Client error
- `403`: Access is forbidden.
- `404`: The server cannot find the requested resource.
- `422`: Client error
- `429`: Client error
- `500`: Server error
- `501`: Server error

---

[API](https://skmtc.dev/skycloak/apis/skycloak-public-api.md) · [All operations](https://skmtc.dev/skycloak/apis/skycloak-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/skycloak/apis/skycloak-public-api/revisions/33a69e2ce35f?raw)