Create a tenant override forwarding destination

post

https://staging.ankatech.co/api/v3/admin/tenants/{tenantId}/event-forwarding/destinations

Creates a TENANT-level override destination for this tenant. The optional transport.trustAnchorsPem member pins the certificate authorities this destination's TLS session will accept; omit it to use the deployment trust store, which is the right configuration for a publicly-trusted collector. The anchor is read, bounded and CA-checked here — before anything is persisted — and only the canonical re-encoding derived from the accepted DER is stored, so two spellings of the same certificate store identically. The response describes each anchor and returns the canonical PEM unmasked: a certificate authority is public material. The sink credential is never returned.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

tenantId

uuid

required

Body Params

name

string

required

length between 0 and 64

^[A-Za-z0-9][A-Za-z0-9 ._-]{0,63}$

Unique destination display label within its plane.

formatter

string

enum

required

Wire encoding the event is rendered into.

Allowed:

sinkType

string

enum

required

Transport/sink driver.

Allowed:

transport

required

Non-secret per-sink transport parameters; the concrete shape is selected by the sibling sinkType discriminator (SPLUNK_HEC/SENTINEL/WEBHOOK/SYSLOG) via EventForwardingDestinationRequestDeserializer.

minSeverity

string

length between 0 and 16

Minimum severity floor a source event must meet.

eventTypeWhitelist

array of strings

Event types to forward exclusively (empty = all).

eventTypeWhitelist

eventTypeBlacklist

array of strings

Event types to drop (empty = drop none).

eventTypeBlacklist

keyIdWhitelist

array of strings

Key ids to forward events for exclusively (empty = all).

keyIdWhitelist

enabled

boolean

Whether this destination is active.

secret

string

Sink credential (write-only). Omit on update to keep unchanged; the mask sentinel is rejected.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

Credentials

Bearer

JWT

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

application/problem+json

201The destination as stored, with the sink credential masked and each pinned trust anchor described.

401Missing or invalid JWT.

403Missing the required scope, or the token names a different tenant than the path. The refusal is identical either way and the trust material is not decoded at all.

409An override destination of that name exists for this tenant.