Set up the ACS API

Before using the ACS API, you must download the ACS Open API 3.0 specification, which includes the parameters, codes, and other data you need to work with the ACS API.

You must also create a JWT authentication token in Splunk Cloud Platform for use with ACS endpoint requests. You can create this token manually in the Splunk Web UI or programmatically using the ACS API.

For details on how to retrieve the ACS Open API spec and create an authentication token, see Set up the ACS API.

How IP subnet limits work

ACS enforces limits on the total number of IP subnets you can add to your IP allow lists. For deployments on AWS, IP subnet limits apply to IP allow list groups for search head, indexer, and IDM tiers, as well as single instances. While a feature maps to a single IP allowlist, a group can map to multiple IP allowlists.

There is a total limit of 230 subnets per IP allow list group. This limit applies to the allow lists for all features across the allow list group. For example, you can add a maximum of 230 subnets to the Indexer group, which includes the allow lists for the hec and s2s features.

The table shows IP subnet limits per IP allow list group for deployments on AWS:

Note that ACS enforces a 200 IP subnet limit for each individual ACS feature allow list, while the total subnet limit of 230 is shared between all feature allow lists in an IP allow list group. The table shows some valid and invalid subnet limit scenarios for the Indexer group: :

For deployments on GCP, you can add a maximum of 200 IP subnets to the IP allow list for each ACS feature.

View current IP allow lists

To view the full list of existing subnets for a particular IP allow list feature type, send an HTTP GET request to the following endpoint:

admin.splunk.com/{stack}/adminconfig/v2/access/{feature}/ipallowlists

For example, to view the full list of subnets for the s2s IP allow list feature type, send the following request:

curl https://admin.splunk.com/{stack}/adminconfig/v2/access/s2s/ipallowlists \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2...'

The request returns the current allow list subnets for the s2s feature type only. For example:

{
  "subnets": [
     ": #.0.0.0/24",
     ": #.0.0.0/24",
     ": #.0.10.6/32"
  ]
}

To view the current allow list subnets for a different feature, you must specify that feature type in the request. See Determine IP allow list use case.

For ACS IP allow list endpoint details, see access/{feature}/ipallowlist in the ACS API endpoint reference.

Add subnets to IP allow list

To add a new subnet to the IP allow list:

Send an HTTP POST request to the access/{feature}/ipallowlists endpoint, specifying the subnet that you want to add. For example, to add new subnets to the IP allow list for the s2s feature:

curl -X POST 'https://admin.splunk.com/mystack/adminconfig/v2/access/s2s/ipallowlists' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiw...' \
--data '{
"subnets": [
"###.0.0.0/24",
"##.0.10.6/32"
]
}'

A 200 response code indicates that your request was submitted successfully.

To check the status of your subnet update request, send an HTTP GET request specifying the {stack} value (URL prefix of your Splunk Cloud Platform deployment) as the only argument. For example:

curl https://admin.splunk.com/{stack}/adminconfig/v2/status \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2...'

ACS returns one of the following status responses:

• Ready: The environment is ready, and infrastructure is up to date.
• Pending: The stack has some pending changes that haven't been applied to the environment yet. The changes could be internal system changes for the environment or user requested changes like a modification to allow lists.
• Failed: There were some errors while applying changes to the environment. The changes could be internal system changes for environments or user requested changes like a modification to allow lists. If you continue to experience errors, contact Splunk Support.

Remove subnets from IP allow list

To remove a subnet from an IP allow list:

Send an HTTP DELETE request specifying the subnet you want to delete. For example, to remove subnets from the IP allow list for the s2s feature:

curl -X DELETE 'https://admin.splunk.com/mystack/adminconfig/v2/access/s2s/ipallowlists' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2Vj...' \
--header 'Content-Type: application/json' \
--data '{
"subnets": [
"###.0.0.0/24",
"##.0.10.6/32"
]
}'

For ACS IP allow list endpoint details, see access/{feature}/ipallowlist in the ACS API endpoint reference.

Confirm IP allow list update

To verify that your IP allow list has been updated as expected by POST or DELETE requests:

Send an HTTP GET request specifying the {stack} value (URL prefix of your Splunk Cloud Platform deployment) as follows:

curl https://admin.splunk.com/mystack/adminconfig/v2/status\
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2...'

View current IP allow lists (IPv6)

To view the full list of subnets for a particular ACS IPv6 allow list feature, send an HTTP GET request to the ipallowlists-v6 endpoint. For example, to view to view IPv6 subnets for the s2s feature, send the following request:

curl -X GET 'https://admin.splunk.com/{stack}/adminconfig/v2/access/s2s/ipallowlists-v6' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc..'

The response lists the current IPv6 subnets for the s2s feature. For example:

{
  "subnets": [
    "fe84:1ee:fe23:3333::/64"
  ]
}

Add subnets to IP allow lists (IPv6)

To add subnets to an IPv6 allow list:

Send an HTTP POST request to the access/{feature}ipallowlists-v6 endpoint, specifying the subnets that you want to add in the request body. For example, to add new subnets to the IP allow list for the s2s feature:

curl -X POST 'https://admin.splunk.com/{stack}/adminconfig/v2/access/idm-api/ipallowlists-v6' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2Vjcm…' \
                 --data-raw '{"subnets": ["fe84:1ee:fe23:1111::/64"]}' | jq

The following response indicates that your request to add IPv6 subnets has been submitted successfully:

{
  "warnings": [
    "IP allow list v6 subnets creation request submitted successfully. Note that it can take several minutes for the subnet update to be applied to your Splunk Cloud Platform stack."
  ]
}

Remove subnets from an IP allow list (IPv6)

To remove a single IPv6 subnet from an allow list, send an HTTP DELETE request fo the access/{feature}ipallowlists-v6 endpoint, appending the specific IPv6 subnet to the request URL. For example:

curl -X DELETE 'https://staging.admin.splunk.com/cads-4941-noah/adminconfig/v2/access/idm-api/ipallowlists-v6/fe84:1ee:fe23:1112::/64' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0I…' | jq

To remove multiple IPv6 subnets from an allow list, send an HTTP DELETE request to the access/{feature}/ipallowlists-v6 endpoint, specifying the subnets you want to delete in the request body. For example:

curl -X DELETE 'https://staging.admin.splunk.com/cads-4941-noah/adminconfig/v2/access/idm-api/ipallowlists-v6' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer eyJraWQiOiJzcGx1bmsuc2VjcmV0Iiw…' \
                 --data-raw '{
                "subnets": [
                 "fe84:1ee:fe23:1112::/64"
                        ]
                }' | jq