REST API Reference

Reference for the Splunk_ML_Toolkit /mltk/** REST API surface, derived from AITK_API_reference.md and AITK_API_summary.md.

Base URL

https://<splunkd>:8089/services/mltk

Authentication

Splunk session token · Authorization: Splunk <token>

Response format

application/json · output_mode=json

Dispatcher

Splunk_ML_Toolkit/bin/util/rest_handler.py

Quick start · curl

curl -X GET 'https://splunkd:8089/services/mltk/agents?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

AI Agents

Endpoints in the AI Agents group of the /mltk/** REST API.

5 endpoints

Example

curl -X GET '$BASE/mltk/agents?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/agents?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X PUT '$BASE/mltk/agents?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X DELETE '$BASE/mltk/agents/{agent_name}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/agents/{agent_name}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

AI Commander (LLM Providers)

Endpoints in the AI Commander (LLM Providers) group of the /mltk/** REST API.

6 endpoints

Example

curl -X GET '$BASE/mltk/aicommander?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/aicommander?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/aicommander_metadata?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/aicommander_metadata?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X DELETE '$BASE/mltk/aicommander/{service}/{connection_name}/{model}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/aicommander/{service}/{connection_name}/{model}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Container Lifecycle (DSDL)

Endpoints in the Container Lifecycle (DSDL) group of the /mltk/** REST API.

14 endpoints

Example

curl -X POST '$BASE/mltk/container_connection?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/container_connection/{container_type}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X DELETE '$BASE/mltk/container_connection/{container_type}/{connection_name}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/container_connection/{container_type}/{connection_name}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/container_data?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/container_logs?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/container_logs?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/start_container?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/start_container?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X DELETE '$BASE/mltk/start_container/{model_name}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/stop_container?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/stop_container?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/test_container_connection?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/test_container_connection?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Experiments

Endpoints in the Experiments group of the /mltk/** REST API.

8 endpoints

Example

curl -X GET '$BASE/mltk/experiments?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/experiments?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X DELETE '$BASE/mltk/experiments/{experiment_id}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/experiments/{experiment_id}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/experiments/{experiment_id}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/experiments/{experiment_id}/clone_models?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/experiments/{experiment_id}/history?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/experiments/{experiment_id}/history?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Feature Flags & Notifications

Endpoints in the Feature Flags & Notifications group of the /mltk/** REST API.

5 endpoints

Example

curl -X GET '$BASE/mltk/agent_feature_flag?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/ctsm_acknowledge?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/ctsm_feature?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/ctsm_feature?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/mltk_feature_flags?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

MCP Connections

Endpoints in the MCP Connections group of the /mltk/** REST API.

6 endpoints

Example

curl -X POST '$BASE/mltk/mcp_connection?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X PUT '$BASE/mltk/mcp_connection?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/mcp_connection[?name=...]?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X DELETE '$BASE/mltk/mcp_connection/{name}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/mcp_connection/test?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/mcp_connection/tools?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Models & External Inventories

Endpoints in the Models & External Inventories group of the /mltk/** REST API.

7 endpoints

Example

curl -X GET '$BASE/mltk/list_connections?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/list_models?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/register_model?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X PUT '$BASE/mltk/register_model?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X GET '$BASE/mltk/register_model?model_name=...?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/register_model?test_connection=1?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/upload_model?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Run History & HEC

Endpoints in the Run History & HEC group of the /mltk/** REST API.

2 endpoints

Example

curl -X PUT '$BASE/mltk/hec_operations?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/run_history?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Vector Stores

Endpoints in the Vector Stores group of the /mltk/** REST API.

5 endpoints

Example

curl -X GET '$BASE/mltk/vector_stores?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/vector_stores?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X PUT '$BASE/mltk/vector_stores?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X DELETE '$BASE/mltk/vector_stores/{connection_name}?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

Example

curl -X POST '$BASE/mltk/vector_stores/test?output_mode=json' \
  -H 'Authorization: Splunk $TOKEN'

Reference

Full documentation →

All custom endpoints are mounted under a single Splunk REST entry-point: /servicesNS/{owner}/Splunk_ML_Toolkit/mltk/<handler>[/<subpath>].

Comprehensive reference for the Splunk AI Toolkit (Splunk_ML_Toolkit) REST API.

All custom endpoints are mounted under a single Splunk REST entry-point:

/servicesNS/{owner}/Splunk_ML_Toolkit/mltk/<handler>[/<subpath>]

Declared in Splunk_ML_Toolkit/default/restmap.conf:

[script:mltk]
match              = /mltk
script             = util/rest_handler.py
scripttype         = persist
requireAuthentication = true
output_modes       = json
passHttpHeaders    = true
passSystemAuth     = true
passPayload        = true
python.version     = python3

Exposed in Splunk_ML_Toolkit/default/web.conf:

[expose:mltk]
pattern = mltk/**
methods = GET, POST, PUT, DELETE

Dispatch is dynamic. The dispatcher at Splunk_ML_Toolkit/bin/util/rest_handler.py takes the first path segment after /mltk/, imports Splunk_ML_Toolkit/bin/rest_handlers/<name>.py, instantiates the matching CamelCase class (name.title().replace('_', '')), and dispatches handle_get | handle_post | handle_put | handle_delete(request, path_parts).

Endpoint groups Permalink to this section

#	Group	Endpoints	Slug
1	Feature Flags & Notifications	5	`/api/feature-flags/`
2	AI Commander (LLM Providers)	6	`/api/ai-commander/`
3	AI Agents	5	`/api/agents/`
4	MCP Connections	6	`/api/mcp-connections/`
5	Vector Stores	5	`/api/vector-stores/`
6	Experiments	8	`/api/experiments/`
7	Models & External Inventories	7	`/api/models/`
8	Container Lifecycle (DSDL)	14	`/api/dsdl/`
9	Run History & HEC	2	`/api/run-history-hec/`

Inventory snapshot Permalink to this section

Total documented endpoints: 36 (from AITK_API_summary.md).

Endpoint	Methods	Handler
`/mltk/agent_feature_flag`	GET	`Splunk_ML_Toolkit/bin/rest_handlers/agent_feature_flag.py`
`/mltk/agents`	GET, POST, PUT	`Splunk_ML_Toolkit/bin/rest_handlers/agents.py`
`/mltk/agents/{agent_name}`	GET, DELETE	`Splunk_ML_Toolkit/bin/rest_handlers/agents.py`
`/mltk/aicommander`	GET, POST	`Splunk_ML_Toolkit/bin/rest_handlers/aicommander.py`
`/mltk/aicommander/{service}/{connection_name}/{model}`	GET, DELETE	`Splunk_ML_Toolkit/bin/rest_handlers/aicommander.py`
`/mltk/aicommander_metadata`	GET, POST	`Splunk_ML_Toolkit/bin/rest_handlers/aicommander_metadata.py`
`/mltk/container_connection`	POST	`Splunk_ML_Toolkit/bin/rest_handlers/container_connection.py`
`/mltk/container_connection/{container_type}`	GET	`Splunk_ML_Toolkit/bin/rest_handlers/container_connection.py`
`/mltk/container_connection/{container_type}/{connection_name}`	GET, DELETE	`Splunk_ML_Toolkit/bin/rest_handlers/container_connection.py`
`/mltk/container_data`	GET	`Splunk_ML_Toolkit/bin/rest_handlers/container_data.py`
`/mltk/container_logs`	GET, POST	`Splunk_ML_Toolkit/bin/rest_handlers/container_logs.py`
`/mltk/ctsm_acknowledge`	POST	`Splunk_ML_Toolkit/bin/rest_handlers/ctsm_acknowledge.py`
`/mltk/ctsm_feature`	GET, POST	`Splunk_ML_Toolkit/bin/rest_handlers/ctsm_feature.py`
`/mltk/experiments`	GET, POST	`Splunk_ML_Toolkit/bin/rest_handlers/experiments.py`
`/mltk/experiments/{experiment_id}`	GET, POST, DELETE	`Splunk_ML_Toolkit/bin/rest_handlers/experiments.py`
`/mltk/experiments/{experiment_id}/history`	GET, POST	`Splunk_ML_Toolkit/bin/rest_handlers/experiments.py`
`/mltk/experiments/{experiment_id}/clone_models`	POST	`Splunk_ML_Toolkit/bin/rest_handlers/experiments.py`
`/mltk/hec_operations`	PUT	`Splunk_ML_Toolkit/bin/rest_handlers/hec_operations.py`
`/mltk/list_connections`	GET	`Splunk_ML_Toolkit/bin/rest_handlers/list_connections.py`
`/mltk/list_models`	GET	`Splunk_ML_Toolkit/bin/rest_handlers/list_models.py`
`/mltk/mcp_connection`	GET, POST, PUT	`Splunk_ML_Toolkit/bin/rest_handlers/mcp_connection.py`
`/mltk/mcp_connection/{name}`	DELETE	`Splunk_ML_Toolkit/bin/rest_handlers/mcp_connection.py`
`/mltk/mcp_connection/test`	POST	`Splunk_ML_Toolkit/bin/rest_handlers/mcp_connection.py`
`/mltk/mcp_connection/tools`	POST	`Splunk_ML_Toolkit/bin/rest_handlers/mcp_connection.py`
`/mltk/mltk_feature_flags`	GET	`Splunk_ML_Toolkit/bin/rest_handlers/mltk_feature_flags.py`
`/mltk/register_model`	GET, POST, PUT	`Splunk_ML_Toolkit/bin/rest_handlers/register_model.py`
`/mltk/register_model?test_connection=1`	POST	`Splunk_ML_Toolkit/bin/rest_handlers/register_model.py`
`/mltk/run_history`	POST	`Splunk_ML_Toolkit/bin/rest_handlers/run_history.py`
`/mltk/start_container`	GET, POST	`Splunk_ML_Toolkit/bin/rest_handlers/start_container.py`
`/mltk/start_container/{model_name}`	DELETE	`Splunk_ML_Toolkit/bin/rest_handlers/start_container.py`
`/mltk/stop_container`	GET, POST	`Splunk_ML_Toolkit/bin/rest_handlers/stop_container.py`
`/mltk/test_container_connection`	GET, POST	`Splunk_ML_Toolkit/bin/rest_handlers/test_container_connection.py`
`/mltk/upload_model`	POST	`Splunk_ML_Toolkit/bin/rest_handlers/upload_model.py`
`/mltk/vector_stores`	GET, POST, PUT	`Splunk_ML_Toolkit/bin/rest_handlers/vector_stores.py`
`/mltk/vector_stores/{connection_name}`	DELETE	`Splunk_ML_Toolkit/bin/rest_handlers/vector_stores.py`
`/mltk/vector_stores/test`	POST	`Splunk_ML_Toolkit/bin/rest_handlers/vector_stores.py`

Backing stores and internal Splunk APIs Permalink to this section

Custom area	Native/internal target	Responsible code
`/mltk/experiments`	`/configs/conf-experiments`	`bin/experiment/experiment_store.py`
`/mltk/experiments/{id}/history`	`/storage/collections/data/experiment_history`	`bin/experiment/history_store.py`
`/mltk/list_models`	lookup table file/model inventory	`bin/rest_handlers/list_models.py`, `bin/models/listmodels.py`
`/mltk/upload_model`	model upload and validation flow	`bin/rest_handlers/upload_model.py`, `bin/util/onnx_util.py`
`/mltk/register_model`	SageMaker model config, credentials, lookup entries	`bin/rest_handlers/register_model.py`, `bin/util/sagemaker_util_extensions.py`
`/mltk/hec_operations`	`/services/receivers/simple`	`bin/rest_handlers/hec_operations.py`
`/mltk/run_history`	`/search/jobs`	`bin/rest_handlers/run_history.py`, `bin/run_history/search_utils.py`
`/mltk/container_connection`	`/configs/conf-container_connections`	`bin/rest_handlers/container_connection.py`, `bin/util/docker_util.py`, `bin/dsdl/docker_util.py`
Container lifecycle endpoints	Docker/Kubernetes control helpers and `dsdl_container.conf`	`bin/rest_handlers/start_container.py`, `bin/rest_handlers/stop_container.py`, `bin/dsdl/configure_handler.py`, `bin/dsdl/docker_util.py`
`/mltk/aicommander`	AI Commander config and KV store data	`bin/rest_handlers/aicommander.py`, `bin/ai_commander/ai_commander_util.py`
`/mltk/mcp_connection`	`aitk_mcp_collection` KV store	`bin/rest_handlers/mcp_connection.py`, `bin/connection_config_manager/mcp/mcp_util.py`
`/mltk/vector_stores`	`aitk_vector_store_collection` KV store	`bin/rest_handlers/vector_stores.py`, `bin/connection_config_manager/vector_db/config_manager.py`
`/mltk/agents`	`aitk_agent_collection` KV store plus `agentstatus` search command	`bin/rest_handlers/agents.py`, `bin/agent_manager/agent_manager.py`

Appendices Permalink to this section

Appendix A: KV-store collections
Appendix B: Capabilities
Appendix C: Source code layout

REST API Reference

AI Agents

AI Commander (LLM Providers)

Container Lifecycle (DSDL)

Experiments

Feature Flags & Notifications

MCP Connections

Models & External Inventories

Run History & HEC

Vector Stores

Endpoint groups Permalink to this section#

Inventory snapshot Permalink to this section#

Backing stores and internal Splunk APIs Permalink to this section#

Appendices Permalink to this section#

Endpoint groups Permalink to this section

Inventory snapshot Permalink to this section

Backing stores and internal Splunk APIs Permalink to this section

Appendices Permalink to this section