Skip to content
DocumentationAPI ReferenceChangelog
API ReferenceTalon Studio v1.0.2-beta

Deployments

Read a workspace's SIEM deployment targets and deploy-readiness state.

List deployment targets

GET/api/v1/deployment-targetsdeployments:read

List the deployment targets a workspace can ship to: its own plus the org-scoped ones. Credentials are never included.

Query parameters
workspaceIdstring (UUID)
Required with an org-scoped token; a workspace-bound token uses its own workspace.
Response
idstring (UUID)
namestring
endpointstring
kindstring
splunk_acs | splunk_rest | splunk_ssh | sentinel_rest | elastic_kibana | chronicle_rest
siemTypestring
splunk | sentinel | elastic | chronicle
scopestring
workspace | org
isDefaultboolean
autoDeployboolean
When on, a commit or merge to deployBranch installs that branch's content on this target automatically. Off by default.
deployBranchstring
Defaults to main. The Community Edition deploys from main only; binding a target to another branch is an Enterprise feature.
healthStatusstring
unknown | healthy | degraded | failed
lastUsedAtstring (ISO 8601) · nullable
createdAtstring (ISO 8601)
updatedAtstring (ISO 8601)
Returned as { data: [...] }. isDefault is set independently per scope: a workspace can have its own default (scope "workspace") and also see an org-scoped default (scope "org") in the same list, both with isDefault: true — don't assume only one row has it.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/deployment-targets?workspaceId=…"
Response
{
  "data": [
    {
      "id": "8f3c2a10-4b7e-4c1d-9a2f-1e6b5d0c7a44",
      "name": "Splunk Prod",
      "endpoint": "https://acme.splunkcloud.com",
      "kind": "splunk_acs",
      "siemType": "splunk",
      "scope": "workspace",
      "isDefault": true,
      "autoDeploy": false,
      "deployBranch": "main",
      "healthStatus": "healthy",
      "lastUsedAt": "2026-09-18T10:02:44.000Z",
      "createdAt": "2026-06-02T08:00:00.000Z",
      "updatedAt": "2026-09-18T10:02:44.000Z"
    }
  ]
}

Get deploy state

GET/api/v1/deploymentsdeployments:read

The workspace's deploy-readiness rollup: overall state, blockers, the release-gate checks, and the latest successful release. Returned as a flat object, with no data envelope.

Query parameters
workspaceIdstring (UUID)
Required with an org-scoped token; a workspace-bound token uses its own workspace.
Response
statestring
The first that applies: deployed — one of the 25 most recent pushes or exports succeeded · ready — the release gate passes · blocked — a recent push failed, or detections exist and the validation check fails · in_progress — detections exist but the gate isn't passing yet · empty — no detections.
readyboolean
Whether the release gate passes.
deployedboolean
blockersstring[]
checksarray
Each gate check: key (project | detections | review | validation | environment | package | target), label, status (pass | fail | warn), detail. The package check (the Splunk app bundle) is only evaluated when the workspace's primary SIEM is Splunk, because the other SIEMs receive detections one by one.
latestReleaseobject · nullable
{ siemType, buildId (nullable), deployedAt (nullable) } for the most recent successful push or export; null if there has been none.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/deployments?workspaceId=…"
Response
{
  "state": "deployed",
  "ready": true,
  "deployed": true,
  "blockers": [],
  "checks": [
    { "key": "detections", "label": "Detections", "status": "pass", "detail": "…" }
  ],
  "latestRelease": {
    "siemType": "splunk",
    "buildId": "talon_studio-1.0.4-a1b2c3d4e5f6",
    "deployedAt": "2026-06-30T14:02:11.000Z"
  }
}