Skip to main content
Splunk Agent Observability provides a public REST API that you can use to interact with the Splunk Agent Observability platform. This guide will help you get started with the Splunk Agent Observability REST API.

​
Get the Base API URL

The first thing you need to call the Splunk Agent Observability API is the base URL of your Splunk Agent Observability API instance. If you’re using an on-premises, standalone, or custom deployment, you have a custom Splunk Agent Observability URL that appears in your browser when you load the Splunk Agent Observability homepage. Replace console in the URL with api to get your base API URL. If you’re using a SaaS deployment, the base API URL is https://app.{realm}.observability.splunkcloud.com/ao/api/. Your realm is the region for your deployment, such as us1.

​
Verify the Base API URL

To verify the base URL of your Splunk Agent Observability API instance, you can send a GET request to the healthcheck endpoint.
The API version will be reported in the response:

​
Authentication

These steps vary depending on your deployment type. Select the tab for your deployment type below to view the documentation.
This section only applies to on-premises, standalone, and custom deployments.For interacting with our public endpoints, you can use any of the following methods to authenticate your requests:

​
API Key

To use your API key to authenticate your requests, include the key in the HTTP headers for your requests.

​
HTTP Basic Auth

To use HTTP Basic Auth to authenticate your requests, include your username and password Base64 encoded in the HTTP headers for your requests.

​
JWT Token

To use a JWT token to authenticate your requests, include the token in the HTTP headers for your requests.
We recommend using this method for high-volume requests because it is more secure (expires after 24 hours) and scalable than using an API key.To generate a JWT token, send a GET request to the get-token endpoint using the API Key or HTTP Basic auth.