REST API reference¶

Everything you can do in the TrackMe UI, you can do through its REST API — the UI itself is built entirely on it. The API is versioned under /trackme/v2/* and is fully self-documenting.

How the API is organised¶

Endpoints are grouped into resource groups by feature area — tenancy (vtenants, virtual_groups, configuration), the six components (splk_dsm … splk_wlk), alerting (alerting, ack), policies, data and ML, operations (maintenance, backup_and_restore, audit …), and integrations (ai, splk_soar, licensing).

Access follows the same three-tier model as the rest of TrackMe, enforced by Splunk capability (see Roles & access control):

Scope	Capability	Reaches
user	`trackmeuseroperations`	Read endpoints (list / get / search).
power	`trackmepoweroperations`	`*/write` — manage entities (ack, set priority…).
admin	`trackmeadminoperations`	`*/admin` — create tenants, policies, trackers; migrations.

Every endpoint requires authentication; there are no anonymous endpoints. All activity is logged, and any change-making call writes audit events (see Events & sourcetypes).

Finding the docs¶

The API documents itself. In the UI, open API & Tooling → TrackMe REST API Reference. The page lists every resource group with its description, a live search box, and quick links to the API and command logs and the auto-discovery command:

Click View Endpoints on any resource group to see each endpoint’s API path, description, HTTP method, and ready-to-copy cURL and SPL examples, plus the full describe schema of its options (required and optional parameters):

From SPL, | trackmeapiautodocs target="groups" lists the resource groups, and | trackmeapiautodocs target="endpoints" lists every endpoint with its URI, HTTP mode, options, and an example. You can call the API from inside Splunk with the | trackme url=… mode=… command, or externally with curl or any HTTP client.

Authenticating from outside Splunk¶

External callers authenticate to splunkd like any Splunk REST client. The preferred method is a bearer token (-H "Authorization: Bearer <token>"); basic auth (-u user:password) also works, as does exchanging credentials at /services/auth/login for a session key used as -H "Authorization: Splunk <token>".

See Splunk’s documentation:

Important

The | trackme SPL command accepts a JSON body with single or double quotes, but a REST call from outside Splunk must send valid JSON with double quotes — a common cause of “bad request” errors when porting an SPL example to curl.