Skip to content
Yagra

update_forward_destination

PUT
/api/v1/forwarding/destinations/{id}
curl --request PUT \
  --url https://example.com/api/v1/forwarding/destinations/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "ca_cert": "example", "community": "example", "dest_kind": "syslog_udp", "enabled": true, "filter": { "conditions": [ { "field": "source_ip", "op": "eq", "value": "example" } ], "mode": "all" }, "name": "example", "pool": "example", "rate_limit_per_sec": 1, "service_account_json": "example", "source_kind": "syslog", "target": "example", "verbatim": true }'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

Destination id

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

Request body for creating/updating a forwarding destination.

object
ca_cert

PEM certificate(s) to trust for a TLS destination, in addition to the system roots. Not a secret, so unlike community it round-trips and an empty value clears it.

string | null
community

SNMP community for re-encoded traps (snmp_trap_udp only). Sealed at rest; on update, omitting it keeps the stored value.

string | null
dest_kind
required

How to speak to the collector.

string
Allowed values: syslog_udp syslog_tcp syslog_tls snmp_trap_udp flow_udp bigquery
enabled

Whether the forwarder should send to it. Defaults to enabled.

boolean
filter

The filter; omitted = forward the whole stream.

object
conditions

The conditions; empty means match everything.

Array<object>

One field op value test. value is always a string so the config has a single JSON shape; [compile] parses it according to the field’s type.

object
field
required

The datum to inspect.

string
Allowed values: source_ip pool kind facility severity hostname app_name message trap_oid varbind src_addr dst_addr proto src_port dst_port src_as dst_as
op
required

The comparison to apply.

string
Allowed values: eq ne contains not_contains prefix regex not_regex in_list in_cidr not_in_cidr lte gte
value

The operand, parsed per field type at compile time.

string
mode

How [Self::conditions] combine.

string
Allowed values: all any
name
required

Human label (unique, 1–120 chars).

string
pool

Restrict to one poller pool; omitted/null = every pool.

string | null
rate_limit_per_sec

Optional messages/second ceiling.

integer | null format: int32
service_account_json

Google service-account key JSON for a bigquery destination. Sealed at rest; on update, omitting it keeps the stored key. Omitting it on create selects Workload Identity (the GCE/GKE metadata server), which stores no secret at all.

string | null
source_kind
required

Which received stream to tee.

string
Allowed values: syslog trap flow
target
required

host:port of the collector.

string
verbatim

Relay the original bytes (default) rather than re-rendering from the parsed fields.

boolean

Responses

Section titled “Responses”

204

Section titled “204”

Destination updated; an omitted secret keeps the stored one

400

Section titled “400”

Edge validation rejected the destination (target, kind pairing, filter, certificate, credential, or rate limit)

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}

401

Section titled “401”

No valid bearer token

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}

403

Section titled “403”

Role lacks the ManageConfig permission

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}

404

Section titled “404”

No such destination

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}

409

Section titled “409”

A destination with that name already exists

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}

503

Section titled “503”

Skeleton mode: no destination store

Media typeapplication/json

The ADR-019 envelope every failure renders as. pub(crate) and schema-bearing so the OpenAPI document can name one error shape for every endpoint (ADR-035) instead of leaving 4xx/5xx bodies undescribed — a client that has to guess the failure shape ends up parsing the success shape and reading undefined.

object
error
required
object
code
required

Stable machine-readable code. Clients branch on this, never on the message.

string
message
required

Operator-facing sentence. Safe to display; never carries an internal error’s own text.

string
Examplegenerated
{
  "error": {
    "code": "example",
    "message": "example"
  }
}