Security operations · Planned

Splunk is not currently available as a native integration.

Export audit evidence through the control API now. Native delivery to Splunk HEC is planned and is not available yet.

Discuss the requirement Read current API behavior

How the connection works

How Splunk works with the gateway

Use the API today

Authorized customers can retrieve audit evidence through the control API. The product does not claim native Splunk delivery before that path exists.

Confirm that Splunk indexed the event

The planned exporter will track Splunk's optional indexer acknowledgment, retry temporary failures, and avoid duplicate audit records.

Isolate each destination

Each connection will bind its HEC endpoint, encrypted token, evidence scope, retry state, and checkpoint to one customer organization.

Current shared controls

What every supported connection includes

Encrypted BYOK credentials that remain hidden after setup Stable model aliases and compatible route targets Organization and key budgets, rate limits, and concurrency limits Observe, Shadow, and Enforce modes with metadata-only evidence

Splunk is not implemented. The controls above describe the gateway baseline, not availability for this planned integration.

Client boundary

AIGHQ_BASE_URL=https://api.aigatewayhq.com/v1
AIGHQ_API_KEY=from-your-workspace
AIGHQ_MODEL=company-approved-fast

Splunk will receive audit evidence. It will not proxy model requests or receive prompt and response content by default.

Implemented boundary

Supported protocols

There is no native Splunk setup today. Use the authenticated control API until the HEC sender, encrypted credential, retry policy, acknowledgment checkpoint, and tenant-isolation tests are released.

HTTPS HTTP Event Collector events Token-scoped authorization Optional indexer acknowledgment checkpoints

Compatibility follows the provider's current published interface. Review the provider documentation before approving Splunk for production.