---
title: "put pub/sub source"
method: PUT
path: "/log-sources/pubsub/{id}"
tags: ["pub/sub source"]
---

# put pub/sub source

`PUT /log-sources/pubsub/{id}`

put updates a pubsub source

## Path parameters

- `id` string, required — ID of the pubsub source to update

## Request body

- PubSubSourceAPIModifyPubSubSource
  - `credentials` string — The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.
  - `credentialsType` 'service_account' | 'wif', required — The type of credentials being used: service_account or wif (Workload Identity Federation).
  - `integrationLabel` string, required — The integration label (name)
  - `logStreamType` 'Auto' | 'JSON' | 'JsonArray' | 'Lines' | 'XML', required — The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML
  - `logStreamTypeOptions` PubSubSourceAPILogStreamTypeOptions
    - `jsonArrayEnvelopeField` string — Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself
    - `xmlRootElement` string — The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element
  - `logTypes` string[], required — The log types for parsing ingested data
  - `projectId` string — The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.
  - `regionalEndpoint` string — Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.
  - `subscriptionId` string, required — The GCP Pub/Sub subscription ID

## Response `200`

OK response.

- PubSubSourceAPIPubSubSource
  - `credentials` string — The GCP credentials JSON content (service account key or WIF config). Required on create, optional on update.
  - `credentialsType` 'service_account' | 'wif' — The type of credentials being used: service_account or wif (Workload Identity Federation).
  - `integrationId` string — The id of the pubsub source
  - `integrationLabel` string — The integration label (name)
  - `logStreamType` 'Auto' | 'JSON' | 'JsonArray' | 'Lines' | 'XML' — The log stream type. Supported log stream types: Auto, JSON, JsonArray, Lines, XML
  - `logStreamTypeOptions` PubSubSourceAPILogStreamTypeOptions
    - `jsonArrayEnvelopeField` string — Path to the array value to extract elements from, only applicable if logStreamType is JsonArray. Leave empty if the input JSON is an array itself
    - `xmlRootElement` string — The root element name for XML streams, only applicable if logStreamType is XML. Leave empty if the XML events are not enclosed in a root element
  - `logTypes` string[] — The log types for parsing ingested data
  - `projectId` string — The GCP project ID. Optional for service_account credentials (derived from the keyfile). Required for WIF.
  - `regionalEndpoint` string — Optional regional endpoint override (e.g. europe-west3). If not set, the global endpoint is used.
  - `subscriptionId` string — The GCP Pub/Sub subscription ID

## Other responses

- `400` — bad_request: Bad Request response.
- `404` — not_found: Not Found response.
- `409` — exists: Conflict response.
- `500` — service: Internal Server Error response.

---

[API](https://skmtc.net/panther/apis/panther-rest-api.md) · [All operations](https://skmtc.net/panther/apis/panther-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/panther/panther-rest-api/versions/eb177cb9d6a1/schema)