Skip to content
DocumentationAPI ReferenceChangelog
API ReferenceTalon Studio v1.0.2-beta

Integrations

Read a workspace's connected SIEMs.

List integrations

GET/api/v1/integrationsintegrations:read

List the SIEMs connected to a workspace: its own plus the org-scoped ones. Connections pending deletion are left out, and credentials are never included.

Query parameters
workspaceIdstring (UUID)
Required with an org-scoped token; a workspace-bound token uses its own workspace.
Response
idstring (UUID)
typestring
splunk | sentinel | elastic | chronicle
transportstring
rest | acs | relay
endpointstring
scopestring
workspace | org
statusstring
active | pending | error
agentAccessstring
off | read | read_actions — off: agents may not query this SIEM at all; read: agents may run guarded read-only searches; read_actions is reserved for a future human-approved remediation gate and does nothing today.
lastSyncedAtstring (ISO 8601) · nullable
lastErrorstring · nullable
Returned as { data: [...] }.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/integrations?workspaceId=…"
Response
{
  "data": [
    {
      "id": "3a1f9c22-7d40-4e88-b1a3-9f2c0e5d6b71",
      "type": "splunk",
      "transport": "rest",
      "endpoint": "https://splunk.example.internal:8089",
      "scope": "workspace",
      "status": "active",
      "agentAccess": "read",
      "lastSyncedAt": "2026-09-24T06:00:00.000Z",
      "lastError": null
    }
  ]
}